Enabling and Disabling the PHP register_globals Directive

The register_globals directive in PHP automatically turns incoming request variables (from forms, cookies, and URLs) into global variables. While this may simplify coding, it introduces serious security risks. For this reason, register_globals was deprecated in PHP 5.3 and removed entirely in PHP 5.4 and later.

Important Notes

• register_globals is disabled by default in supported environments.
• Enabling it can expose your application to vulnerabilities such as variable injection and unauthorized access.
• Only older PHP versions (≤ 5.3) support this directive.

How to Enable or Disable register_globals

1. Using a Custom php.ini File

Edit or create a php.ini file in your application directory:

; Enable register_globals
register_globals = On

; Disable register_globals
register_globals = Off

2. Using .htaccess

On Apache servers, you can override the directive in .htaccess:

# Enable
php_flag register_globals On

# Disable
php_flag register_globals Off

3. Using .user.ini

If your hosting environment supports .user.ini, add:

register_globals = Off

Best Practices

• Always keep register_globals disabled to protect your application.
• Use $_GET, $_POST, and $_COOKIE superglobals explicitly instead of relying on automatic variable creation.
• If you are running PHP 5.4 or later, this directive is no longer available.