PHP - turning register globals off, what is the best way to go about fixing the code?

Question

I am working on a old code base, where programmers assumed that register_globals will always be on. Hence variables are used without $_GET or $_POST prefix, pretty much in every page (the code base is huge, hundreds of scripts). I tried turning it off, but the very first script (login script) goes on an infinite loop.

I understand that going through one script at a time, and one line at a time and fixing the variables is probably the only option (adding the prefix $_GET or $_POST as the case may be). Has anyone does this before? How did you go about doing it? Any advice?

Answer 1

This may result in more damage than good but:

1. Grep out the name="foo" elements from forms into a CSV or line seperated list something and get the action attribute (only if it relates to an actual script)
2. go through the CSV or line-separated list and do a find and replace using sed to replace $currentval with $_POST['currentval']/$_GET['currentval'] or $_REQUEST['currentval'] (but beware cookies)

for example:

grep -o -E "(action|name)=\"[a-zA-Z0-9_]+\"" formfile.php | sed -E "s/.*\"([a-zA-Z0-9_]+)\"/\\1/" > vars.list

Will give you a line separated list of posted variables (ish) which you can loop through in a bash script or something to replace the vars.

EDIT

If you want to turn register globals on for one site. Add to your .htaccess or Apache config:

php_value register_globals "On"

Answer 2

You can replicate register_globals using the following code:

foreach ($_REQUEST as $var => $val) $$var = $val;

All you then need to do is find a way to have this line run before each script. You can do this in a number of ways:

1. Copy and paste it into the beginning of each file;
2. Using mod_rewrite in such a way as to turn each request into (for example) register_globals.php?forward_to=originally_request_file.php where register_globals.php contains the above line ad then includes the $_GET['forward_to'] file;
3. There is a directive auto_prepend_file in your PHP config which will run a specific script before each file is run as it would be ordinarily. You could have it point to a file with the above line in it. More: http://php.net/auto-prepend-file

Further to point (3), you can set this up in the .htaccess file as follows:

php_value auto_prepend_file /var/www/register_globals.php