Question

Is there anything problematic in simply setting $GLOBALS to be an empty array? I want to reverse the effect of register_globals where it is turned on and one does not have access to the .ini file, but rather than iterate over each of the relevant super globals and unset where necessary, skipping such elements as $GLOBALS['_POST'], $GLOBALS['_GET'], etc. as is usually done, I wonder if it’s OK to just remove them all.

Are there any problems that may arise from this? I don’t ever plan to reference the $GLOBALS array as any variables that are to be scope-independent will either be set in the relevant super global ($_GET, $_POST, etc.) or will be stored as properties of a relevant registry class.

For information, the FAQ at http://www.php.net/manual/en/faq.misc.php#faq.misc.registerglobals has the following to emulate register_globals = 0:

<?php
// Emulate register_globals off
function unregister_GLOBALS()
{
    if (!ini_get('register_globals')) {
        return;
    }

    // Might want to change this perhaps to a nicer error
    if (isset($_REQUEST['GLOBALS']) || isset($_FILES['GLOBALS'])) {
        die('GLOBALS overwrite attempt detected');
    }

    // Variables that shouldn't be unset
    $noUnset = array('GLOBALS',  '_GET',
                     '_POST',    '_COOKIE',
                     '_REQUEST', '_SERVER',
                     '_ENV',     '_FILES');

    $input = array_merge($_GET,    $_POST,
                         $_COOKIE, $_SERVER,
                         $_ENV,    $_FILES,
                         isset($_SESSION) && is_array($_SESSION) ? $_SESSION : array());

    foreach ($input as $k => $v) {
        if (!in_array($k, $noUnset) && isset($GLOBALS[$k])) {
            unset($GLOBALS[$k]);
        }
    }
}

unregister_GLOBALS();

?>

Presumably performing unset($GLOBALS[$k]); does the same as performing $GLOBALS = array(); except that the latter removes everything and involves only one line of code.

The question then is: is it bad to unset $GLOBALS['_GET'], $GLOBALS['_PUT'], etc. (“the variables that shouldn’t be unset” as the example states — is this really the case?)?

Update:

I’ve answered this myself below. Silly me for not trying earlier.

Answer 1

I’ve answered part of this myself. I was stupid for not trying earlier:

$var = 'Hello, world!';

unset($GLOBALS['var']);

echo $var; // Notice: Undefined variable: var



$var = 'Hello, world!';

$GLOBALS = array();

echo $var; // Hello, world!

So simply setting $GLOBALS as an empty array won’t unset the global variables. They need to be explicitly unset.

Update:

Using unset($GLOBALS['_GET']); is the same as using unset($_GET) which is definitely not what I want. Question answered.