PHP security issues / bad feature #php

Register Globals (register_globals)
In short, register_globals was meant to help rapid application development. Take for example this URL, http://yoursite.tld/index.php?var=1, which includes a query string. The register_globals statement allows us to access the value with $var instead of $_GET['var'] automatically. This might sound useful to you, but unfortunately all variables in the code now have this property, and we can now easily get into PHP applications that do not protect against this unintended consequence.
 The following code snippet is just one common example you will see in PHP scripts:

eg :if( !empty( $_POST['username'] ) && $_POST['username'] == 'test' && !empty( $_POST['password'] ) && $_POST['password'] == "test123" )
{
    $access = true;
}

f the application is running with register_globals ON, a user could just place access=1 into a query string, and would then have access to whatever the script is running.



Disabling with .htaccess

php_flag register_globals 0

Disabling with php.ini

register_globals = Off

 Ref:http://net.tutsplus.com/tutorials/php/5-helpful-tips-for-creating-secure-php-applications/