<p>I have inherited some legacy PHP code what was written back when it was standard practice to use <a href="http://php.net/register_globals" rel="nofollow noreferrer"><code>register_globals</code></a> (As of PHP 4.2.0, this directive defaults to off, released 22. Apr 2002).</p>

<p>We know now that it is bad for security to have it enabled. The problem is how do I find all the places in the code where I need to use <code>$_GET</code> or <code>$_POST</code>? My only thought was to set the error reporting to warn about uninitialized variables and then test each part of the site. Is there an easier way? Will I have to test each code path in the site or will PHP give a warning on a file basis?</p>

[{'answer_id': 6673, 'author': 'Teifion', 'author_id': 1384652, 'author_profile': 'https://Stackoverflow.com/users/1384652', 'pm_score': 0, 'selected': False, 'text': '<p>I know that there\'s a way to set php.ini values for that script with a certain command, I thus went looking and found this too - <a href="http://forums.macosxhints.com/archive/index.php/t-8538.html" rel="nofollow noreferrer">Goto last post on page</a></p>\n\n<p>I also found the following post which may be of use - <a href="http://www.webmasterworld.com/forum88/1584.htm" rel="nofollow noreferrer">Goto last post on the page</a></p>\n\n<p>I will add to this more if nobody has found an answer but I must now catch a train.</p>\n'}, {'answer_id': 6694, 'author': 'Marie Fischer', 'author_id': 719, 'author_profile': 'https://Stackoverflow.com/users/719', 'pm_score': 4, 'selected': True, 'text': "<p>If you set error reporting to E_ALL, it warns in the error log about undefined variables complete with filename and line number (assuming you are logging to a file). However, it will warn only if when it comes across an undefined variable, so I think you will have to test each code path. Running php from the command line doesn't seem to help also.</p>\n\n<p>There is a debugging tool named xdebug, haven't tried it, but maybe that can be useful?</p>\n"}, {'answer_id': 7463, 'author': 'grom', 'author_id': 486, 'author_profile': 'https://Stackoverflow.com/users/486', 'pm_score': 2, 'selected': False, 'text': '<p>I wrote a <a href="http://pastebin.com/f6f379371" rel="nofollow noreferrer">script</a> using the built-in <a href="http://au.php.net/manual/en/ref.tokenizer.php" rel="nofollow noreferrer">Tokenizer</a> functions. Its pretty rough but it worked for the code base I was working on. I believe you could also use <a href="http://pear.php.net/manual/en/package.php.php-codesniffer.php" rel="nofollow noreferrer">CodeSniffer</a>.</p>\n'}, {'answer_id': 13758, 'author': 'Eric Goodwin', 'author_id': 1430, 'author_profile': 'https://Stackoverflow.com/users/1430', 'pm_score': 2, 'selected': False, 'text': "<p>You could manually 'fake' the register globals effect but add some security. (I partly grabbed this from the osCommerce fork called xoops)</p>\n\n<pre><code>//  Detect bad global variables\n$bad_global_list = array('GLOBALS', '_SESSION', 'HTTP_SESSION_VARS', '_GET', 'HTTP_GET_VARS', '_POST', 'HTTP_POST_VARS', '_COOKIE', 'HTTP_COOKIE_VARS', '_REQUEST', '_SERVER', 'HTTP_SERVER_VARS', '_ENV', 'HTTP_ENV_VARS', '_FILES', 'HTTP_POST_FILES');\nforeach ($bad_global_list as $bad_global ) {\n    if ( isset( $_REQUEST[$bad_global] ) ) {\n        die('Bad Global');\n    }\n}\n\n//  Make global variables\nforeach ($_REQUEST as $name -&gt; $value) {\n    $$name = $value; // Creates a varable nammed $name equal to $value.\n}\n</code></pre>\n\n<p>Though you'd want to tweak it to make your code more secure, at least by adding your global configuration variables (like the path and base url) to the bad globals list.</p>\n\n<p>You could also use it to easily compile a list of all used get/post variables to help you eventually replace all occurrences of, say $return_url, with $_REQUEST['return_url]; </p>\n"}]
['https://Stackoverflow.com/questions/6633', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/796/']