Question

I’m working on application built years ago, that has recently stopped working correctly. Old programmer said, that he might be accessing $_GET or $_POST variables without reading them from $_GET[] array, but through the register_globals

I want to ask: What are different ways to access $_GET variables without using $_GET[] array (e.g. direct ways?) and, if known, how can I check if this application uses any of them?

Thank you in advance

EDIT: The other ways I remembered was register_globals, not magic_quotes. Also, I do not wish to use it, but rather detect if it was used and in latest server update deprecated (what could explain why app stopped working correctly)

EDIT: My english is horrible today. As I explained in one of answers: I need to check, whether original programmer used some obscure and/or deprecated method of getting variables from query string to PHP, so the values application now works with are wrong/not initialized

IMPORTANT EDIT: import_request_variables is off the table, it isn’t used. All $_ arrays are off the table too, because latest update wouldn’t broke them (=>they still work). How can I detect what variables are initialized with register_globals?

YET ANOTHER EDIT: I found this:

foreach ($_POST as $k => $v) {
  eval("\$".$k." = '".$v."';");
}
foreach ($_GET as $k => $v) {
  eval("\$".$k." = '".$v."';");
}

Could it have been broken by one of latest updates (max. 1 week ago)?

Answer 1

You mean through Register Globals and not Magic Quotes… BTW Register Globals is pure evil never use them (and they are deprecated as of PHP 5.3.0)!

Edit: If you want to check if the application used Register Globals, try to search for $_GET values as variables. For example for index.php?id=123 try to look for $id in the PHP code. If you find it this does not mean that the script uses Register Globals but if $id comes from nowhere and is never initialized/setted it’s a good (bad!) sign that the app uses Register Globals…