3 replies to this topic

[Jeremy Trask]

Hi

In the words of the PHP developers: "This feature has been DEPRECATED as of PHP 5.3.0. Relying on this feature is highly discouraged." It relates to the automatic creation of variables which, in conjunction with improperly written code, could cause security issues. Generally speaking these days there should be no code that depends on having this feature enabled and if you did have such code on your site it would be recommended to update or replace such code. If you have an up to date installation it is very unlikely that this will be the case so it is advised to disable it, which is the default value anyway. The reason that it is often enabled is because hosts don't want to "break" software that may be installed in a hosting account so they enable it by default.

So the warning that ServerBuddy gives is based on the current recommendation for the setting of this value.

This would normally be disabled by a setting in a php.ini file or similar but the best thing to do is to consult your host support who will be able to advise you more specifically on how to disable this on their servers, thanks.

Regards...jeremy

[Bet Hannon]

Hi Jeremy!  I'm having this same issue.  I have a support ticket in with the hosting company, but if they refuse to disable PHP Register Globals, can you point me to instructions for trying to disable it in a php.ini file?

[Jeremy Trask]

Hi Bet

The config item you'd want in a php.ini would be:

register_globals = Off

or alternatively if you have to do this in a .htaccess file then

php_flag register_globals off

Depending on how you server is configured you may have to put this in multiple directories, e.g., some servers are configured for a "master" php.ini whilst others are per-directory so if you have scripts running from multiple places you might need to put the config in multiple places. Generally if this is the case (per-directory php.ini) for a WordPress installation I put a php.ini in the site root and also one in wp-admin and this generally seems to cover most bases.

Hopefully you host will give you the same advice (or at least similar but specific for their servers) - I can't think why they wouldn't allow or tell you how to do this for your site but if not it would be interesting to know why.

Hope that helps.

Regards...jeremy