FATAL ERROR: register_globals is disabled in php.ini

[jschafer52]

FATAL ERROR: register_globals is disabled in php.ini, please enable it!

this is what i get when i try to look at pull up my site, i transfered my site from to a new server and when i try to pull it up this is what i get now.

can anyone start me in the right direction?

Thanks
JIM

[brewer1st]

You should first ask your host to enable register_globals for you. If they cannot or will not you could try to change it by using an .htaccess file. In the root of your site look for a file named .htaccess If there isn't one try to add one.

To an exiting .htaccess add

php_value register_globals 1

Or create a new file with just that line in it.

You may not be able to see the .htaccess file depending on what you use to ftp the files to the server.

[Deal-Shop]

i did a few things including that on my server and it still dont work

[jschafer52]

same thing here

[jpf]

These are in the order of perfernce:

Solution #1
In an editor create a file called:
.htaccess
(must have the period before - and nothing before the period)
add to that file the line:
php_value register_globals 1

Make sure your FTP software displays system files as well.

Upload that file to your root of your website.

Solution #2
Find a copy of php.ini in your (virtual) webserver and find (or if blank/missing add)
register_globals=off
and change to
register_globals=on

Solution #3
Ask your hosting company to change for you.

Solution #4
If hosting co - refuses to help or change this for you then move hosts!
if that is not much of an option - you can try the register_globals=off contribution that is posted in the forum here somewhere - but I have not used it - Mileage may vary.

[allwebnow]

I just keep getting an internal server error when I do this. Does php_value register_globals 1 Really work? I'm thinking not, or there's something else that needs to be configured somewhere. I jsut have to delete that code and turn register_golbals back on again so my site works again. It's so annoying cuz it's such a security issue.

[jpf]

Yes it CAN - but ONLY if allowed.

No it is NOT a security issue. It is a BAD CODEing issue. The problem come in the form that IF YOU DON'T CHECK inputed values. That if you "run" these values the "values" that some one entered could contain code. IE SQL insertions .....

Bad programing can lead to big security issues.


Most people don't really know what the real "security issue" is and it is easier JUST TO PLAY DUMB/EASIER TO SAY "we don't allow it"


Easier to enable it if you own the server. Complicated if you don't. Try the contribution that allow you to turned it off.

[allwebnow]

Originally Posted by jpf

Yes it CAN - but ONLY if allowed.

How can this .htaccess line of code be allowed?

Also, I have heard many places that having register globals On serverwide is a security issue when you're hosting hundreds of accounts.

Thanks for the response.
Ben

[jpf]

I can think of several that have it turned on - or allow per site via there own virtual PHP.INI file or .htaccess

Like I said - it is ONLY a security issue if you have poorly coded PHP. Like many beginner that have not properly checked there inputed variables. Like in a "search" box - you normally just put your search terms.....what if you put an SQL command and you passed that directly to your SQL statement - possible to delete/change/list "other" things - when all you wanted to do is get a list of search terms..... This is call SQL insertion.

Like I said - many people see "security issue" and don't really read why.

osCMax is installed on thousands of servers with it turned on. Hundreds of thousands for all variation of OSCommerce - if it was a problem would all sites would have been cracked by now. The worst that I have seen lately about OSC - is spam bots using your "contact us" forms and customer "reviews" - a fix was issued over a year ago for that.

[allwebnow]

Originally Posted by jpf

I can think of several that have it turned on - or allow per site via there own virtual PHP.INI file or .htaccess

As I asked above...How do you allow this per site fix? And For Years I've had register_globals ON serverwide for Oscmax and oscommerce to work. That's not the issue. Now, I would like to have it OFF serverwide and On per user account becuase I don't trust my clients' php scripts they upload due to having been hacked too many times from poor php scripting. I've added the php.ini file to the oscmax directory with register_globals = On in it and still get internal server error. I use phpsuexec so I'm thinking it's not allowing me to do the .htaccess fix. I have several oscmax installations and would hate to have to install the contribution to fix the register_globals issue on each install. Any additional help would be much appreciated!