register globals php
<p>I know register globals should not be used but cannot quite understand why? </p>

<p>For example: this is the code that I find so often to demonstrate the security risk of using register globals while passing something like <code>example.com?authorized=1</code> to the script:</p>

<pre><code>if (authenticated_user()) 
{ 
$authorized = true; 
} 

if ($authorized) 
{ 
include '/highly/sensitive/data.php'; 
} 
</code></pre>

<p>My question is if the user has to pass <code>authorized=1</code> in the url he should be aware of the variable names that i use in my script, right? How is that possible?</p>

<p>Also isn't a function like <code>parse_str()</code> which behaves somewhat similar to register globals a security risk too? </p>
