A brief unofficial history about register_globals in PHP

It’s been a long road and exactly five years (35 releases) since the much discussed and highly controversial PHP directive register_globals has been disabled by default in PHP. After sifting through the mailing list archives, the following set of information has been compiled. Feel free to make additions, corrections, and report register_globals memories!

First, a few tidbits

  • As of today, April 22, 2007, register_globals has been disabled (by default) for five years. That’s when PHP 4.2.0 was released.
  • PHP 3 did not have register_globals because it was simply how PHP behaved. However, some people used $HTTP_*_VARS if track_vars was on (it was on by default, and always on since PHP 4.0.3).
  • You cannot set register_globals at runtime, and there have been at least 100 [deleted] user comments within the manual showing hacks how. This FAQ shows how. Don’t do it though.
  • The order variables are registered via register_globals is determined by variables_order, a directive that also affects which variables (including superglobals) will exist in PHP. Don’t let the name fool you, this is one powerful PHP directive! In PHP 3, gpc_order was used instead.
  • Most “Why PHP is insecure” articles show how to write insecure code with register_globals = on, and eventually register_globals (not poor programming) is blamed as the culprit. It rarely is.
  • Strangely the 4.2.0 release announcement does not contain the string “register_globals” but of course it refers to it, and is highlighted in the ChangeLog.
  • There’s plenty of code within cvsold.php.net that requires register_globals = on but that’s okay because it’s not a big concern. It however is slowly being updated.

A somewhat brief timeline

  • Jan 01, 2000: It was briefly named gpc_globals, but renamed in PHP 4 Beta 4
  • Apr 07, 2000: Zeev creates php.ini-recommended, it contains “register_globals = off” (Originally named php.ini-optimized)
  • May 22, 2000: PHP 4.0.0 is released, and register_globals is born.
  • Aug 23, 2000: It was first documented by James Moore.
  • Sep 05, 2000: Rememberable quote: “… he who doesn’t do anything, doesn’t go wrong.~~ Zeev Suraski
  • Sep 10, 2000: Zeev asked for register_globals and $HTTP_*_VARS to be well documented (Lars Torben Wilson does so immediately).
  • Oct 11, 2000: PHP 4.0.3 is released, and the track_vars directive is removed so the $HTTP_*_VARS variables are now always defined. Also, the old school magical use of <? php_track_vars ?> is removed.
  • Oct 20, 2000: The last version of PHP 3 is released (3.0.18).
  • Jul 03, 2001: The paper “A Study In Scarlet” is written and passed around. This rapidly fueled anti-register_globals sentiment.
  • Jul 07, 2001: After some discussion, Rasmus debunked it and explained why register_globals is not insecure. Thoughts of a filter mechanism start brewing.
  • Jul 29, 2001: Rasmus submits a proposal for adding the super globals, and for a function that eventually becomes import_request_variables(). Also, this records the first use of the string “super-globals”
  • Aug 03, 2001: A bug report asks about setting register_globals via ini_set() and the topic is documented a day later. You can’t, but people keep trying. Well you can, but it won’t be very useful.
  • Aug 08, 2001: The register_globals = off change almost happened in PHP (4.0.7|4.1.0) but additional time was allowed to pass.
  • Aug 11, 2001: A note is added to php.ini-dist referring to the security section in the manual, a section that advises register_globals = off
  • Dec 05, 2001: Derick records the first use of the string “superglobals”
  • Dec 10, 2001: PHP 4.1.0 is released thus giving birth to our superglobals. A warning about register_globals = on is provided, and register_globals is officially deprecated. The name autoglobals was also used for a while.
  • Mar 06, 2002: Carl is born, and it’s generally hoped that he’ll live in a world free from register_globals and magical quotes.
  • Apr 22, 2002: PHP 4.2.0 is released, PHP now defaults to register_globals = off!
  • Apr 22, 2002: From this date forward, questions about why is $PHP_SELF empty, where is $foo, and the like are asked around the world. Many types of answers result but eventually users start understanding what happened and stop reading old outdated tutorials and books. Painful but in the end worth it. For it has been written, without pain there can be no gain.
  • Jul 13, 2004: PHP 5.0.0 is released. From Beta 1 (Jun-29-2003) 2-3-4, RC 1 (Mar-18-2004) 2-3, to an eventual release. Also, the register_long_arrays directive is created which deprecates the $HTTP_*_VARS.
  • Aug 12, 2005: A post titled PHP 6.0 Wishlist is submitted, and Rasmus wished for the removal of register_globals. As it turned out, everyone was hoping and thinking about the same wish. The thread is long.
  • Mar 07, 2006: Pierre removes register_globals from CVS HEAD (PHP 6).
  • Apr 22, 2007: The fifth year anniversary of register_globals being off by default, where has all the time gone?!
  • Apr 22, 2007: SE results for register_globals (G! 2,830,000, Y! 1,740,000), and for superglobals (G! 75,400, Y! 71,600).
  • Unknown 2008: PHP 6 is released, and register_globals no longer exists. RIP!

Happy 5th Anniversary “register_globals = off” … thank you for all the lengthy discussions and strong memories. It’s been a long and eventful ride!

18 Comments to “A brief unofficial history about register_globals in PHP”

  1. PHPDeveloper.org 23 April 2007 at 12:49 #
  2. dustbunny 9 September 2010 at 07:17 #

    2010: PHP6 is dead, but register_globals still stays there.

  3. Xavier 24 January 2013 at 23:19 #

    Heya i’m for the primary time here. I came across this board and I find It truly useful & it helped me out much. I am hoping to give one thing again and help others such as you aided me.

  4. Elvis 25 February 2013 at 17:17 #

    Definitely believe that which you said. Your favorite reason seemed to be on the internet the simplest thing to be aware of. I say to you, I certainly get annoyed while people think about worries that they plainly do not know about. You managed to hit the nail upon the top and also defined out the whole thing without having side-effects , people can take a signal. Will likely be back to get more. Thanks

  5. The spirit of disagreement show, the EMR systems offer
    positives and negatives. I’ve used EMR systems for over 5 years, and such as the positives they offer. Even so, the angst presented by Dr. Schoeffler represent really real frustrations plus the other aspects presented by Dr. Wolin regarding the lack of interoperability represent justifiable worries. While the systems benefits insurers and government most, the move by these while in the IT field to use additional practitioners in forming systems shows that some in the complaints have been heard. While in the end, what do we seriously want EMR to perform for us as providers? Assist us consider greater care of our patients and make factors superior for us. In a nutshell, that about covers it. Around the cost difficulties side, if it can do that, each of us can have a number in mind regarding what that is well worth to us. None of us like having factors rammed down our throat. Most of us worked half our lives to acquire in which we are and do not like someone with an alternate degree lecturing us on tips on how to do our job any much more than they would like us telling them the way to do theirs. In the end, working together will require greater interoperability among systems, improved security measures to protect our patients (and us) from predators of a variety of sorts, improvements to the flexibility of systems to change to meet our needs, and making it a lot more consumer friendly both in use and in reporting (so we usually are not embarrassed when we send our chart to a fellow medical provider for specialty care.) That should sum up our goals and like it or not, medicine and IT will need to roll up our sleeves together, wade within this together, and make these goals a reality within a cost that everyone can live with.

  6. tuneup media gold mac free 16 July 2013 at 14:08 #

    Considered one of the finest pieces of time management advice I read through in a magazine
    numerous many years ago. It was to schedule your to-do list as duties into
    your calendar. That way, you don’t have an ongoing, neverending list of things to perform, and also you obtain a better idea of how substantially time to allocate to them.

  7. nike foamposite for cheap 6 August 2013 at 08:38 #

    Real excellent info can be found on website . “The absence of flaw in beauty is itself a flaw.” by Havelock Ellis.

  8. Thanks for this share.. Although I have witnessed several blogs with list of
    SEO apps. These seems fairly useful for me Adam recently posted..Finest Android Apps
    for Vehicle Owners (dofollow)

  9. ¥¨¥¢¥¸¥ç©`¥À¥ó 18 October 2013 at 10:32 #

    Have An individual Read Which Samsung Unveils Corby HandsetsSamsung possesses intrdouced only two innovative mobile handsets towards it is distinct kitchen appliances Coby, the particular teenagers on Eu for being adedd. The modern units incllude the particular Coprby Corby (TXT) as well as Coprby (PRO), that happens to be made available with the particular originaal Corby S3650-Mobile, currently availlable. A Cotrby (TXT) can also be knnown given that the B3210 and contains any 2. 2-inch LCD, 2MP camcorder utilizing training video aid, bundled FM tuner, unpredictable includes, as well as 40 MB from on the machine memory space expandable by having a microSD account slots. The iphone blends with BENEFIT GPRS communities Quad-band. A mobile handset can be availabe on Eu before ending from Sept. A Crby (PRO) handet provides a QWERTY kyboard as well as works out over the 900 2100MHz HSDPA 7. 2Mbps mobile phone network. A phpone carries a 2. 8-inch touchscreen display screen LCD aid and any 3MP camcorder. A camcorder are also able to document any training video. Otehr elements comprise of the Radio utilizing RDS, extrenal covers, Wi-Fi, Bluuetooth, Mirco UNIVERSAL SERIAL BUS, 100 MB memory space by using a microSD account slots and even more. A mobile handset definitely will mail on December. Almost the entire package Reasons for having A LG KP500 Cellular phone PhoneMobile phonees tend to be at most simply just talking machines. Currently, a lot of people try to be contemporary thewse machines, gammes systems as well as vendor from Online products and services. Good to check out of which thhese microscopic appliances were fruitfully put together these kind of essential featurers. A LG KC910 is normally 1 sharp mobile handsets which can be avaoilable over the cell speaking sector. This specific pohne posseses an concept of which foliage any huge imprint during the memories from potential customers. In case you are zealous abotu the particular camcorder, that can drive any couplpe from snap shots from great consequently this unique LG phne is normally required in your case. There is 8-megapixel camcorder is definitely the imzage conclusion from 3264 times 2448 pixels. Morover, this unique machine has the benefit of elements enjoy motor center, training video recordinng, as well as vidoe camcorder get in touch with. Gamerts is going to often be happpy on this machine, when she has enhanced efatures good activity. They have plenty of game which you could engage in aytime as well as everywhere. For the toher hands, this unique machine will come in dark colored coloor, that is definitely the most popular colors worldwide. Simply by purchasing this unique machine implies which you could ship as well as have e-maipls utilizing attachemnts inside of a extra rapiid technique. This specific phoone can be helpful for personnel so, who usually should examine their own mail whle they are simply not even looking at their own Computer systems. LG KP500 Piece of food an additional device via LG is really a effective maker. This specific variety Piece of food cellular possesses countless elements of which absolutely produce the particular mpobile individuals tend to be dependnet about them. This specific wonderful appliance will come in many colours, enjoy dark colored, Vandyke brown lightly, anodized silcver as well as golden fashionable. You should buy this unique cellular on all of these colours. There are a number folks who like to acquire mobile handsets according to thheir favoruite colours as well as horoscope. This specific communicationms machine provides a camcorder 3. 2 the mega pixels whicch the particular persona reslution from 2048 times 1536 pxels. This specific camcorder will take high-quality imaegs, and obtain tese snap shots via the web, protect on your desktop or even get them from prrint as well as, consequently, made available individuals. With standby option, it is variety is normally 350 several hours as well as chat this unique machine.

  10. Geraldine 12 November 2013 at 18:43 #

    What i do not understood is actually how you are no longer actually much more smartly-favored than you may be now. You’re very intelligent. You already know thus significantly when it comes to this matter, produced me for my part believe it from numerous numerous angles. Its like women and men aren’t interested unless it is one thing to accomplish with Woman gaga! Your own stuffs excellent. All the time deal with it up!

  11. Ignacio 26 November 2013 at 15:05 #

    Howdy just wanted to give you a quick heads up. The words in your content seem to be running off the screen in Opera. I’m not sure if this is a format issue or something to do with browser compatibility but I figured I’d post to let you know. The style and design look great though! Hope you get the issue fixed soon. Thanks

  12. Berniece 28 November 2013 at 06:35 #

    I have been surfing online more than 3 hours lately, yet I by no means discovered any interesting article like yours. It is pretty worth sufficient for me. In my view, if all web owners and bloggers made just right content material as you did, the internet will probably be a lot more useful than ever before.

  13. Eric 3 December 2013 at 18:34 #

    What i don’t realize is if truth be told how you are no longer actually much more smartly-preferred than you may be now. You’re so intelligent. You understand therefore significantly with regards to this matter, produced me individually believe it from so many numerous angles. Its like women and men aren’t involved except it’s something to accomplish with Woman gaga! Your personal stuffs great. Always maintain it up!

  14. Lida 31 January 2014 at 05:06 #

    These drastic side effects could kill you if not taken safety measures right away.
    website and cancelled my autoship that was required to get the
    free trial.

  15. TURBO RACING LEAGUE HACK 13 March 2014 at 20:01 #

    Well, first of all the Z car is legendary and the Z32 TT not only lived up to the Z name
    but it blew all predecessors out of the water. The 27-car race
    lineup will include IZOD Indy – Car Series points leader Will Power and runner-up Helio Castroneves, representing
    Team Penske, last-year’s Kansas winner; Scott Dixon of Target Chip
    Ganassi Racing, who has 21 IRL wins in his eight seasons of Indy racing, including championship seasons in 2003 and 2008; Ryan Hunter-Reay, currently third
    in the points standings, and female favorite Danica Patrick, both driving under the Andretti Autosport banner, and Dan Wheldon of Panther Racing.

    However in 2012 Indy – Car competitors will have the exciting opportunity to choose an Indy – Car with a Lotus engine and aero
    body kit, immediately become part of a legacy that is Lotus:
    one of the most innovative and successful sports and racing car brands
    in the world.

  16. Barrett 16 March 2014 at 23:03 #

    Hello, I think your web site might be having browser compatibility issues.
    Whenever I look at your website in Safari, it looks fine however when opening in IE, it has some overlapping issues.

    I simply wanted to provide you with a quick heads up!
    Other than that, excellent blog!

  17. “We’re investigating reports of an issue with Gmail. We will provide more information shortly,” the company said on its “App Status” dashboard online, which tracks the state of various Google services.

  18. Norma 14 April 2014 at 11:09 #

    Have you ever thought about including a little bit more than just
    your articles? I mean, what you say is important and all.
    However imagine if you added some great graphics or video clips to give
    your posts more, “pop”! Your content is excellent but with pics and
    videos, this blog could undeniably be one of the greatest in its field.
    Superb blog!

Leave a Reply