Setting the PHP register_globals Directive in an .htaccess File

The register_globals directive in PHP automatically creates global variables from request data (such as form inputs, cookies, and query strings). While this may simplify coding, it introduces serious security risks. For this reason, register_globals was deprecated in PHP 5.3 and removed entirely in PHP 5.4 and later.

Important Notes

• register_globals is disabled by default in supported environments.
• Enabling it can expose your application to vulnerabilities such as variable injection and unauthorized access.
• Only older PHP versions (≤ 5.3) support this directive.

Steps to Configure register_globals in .htaccess

Step 1: Access Your Hosting Account

• Log in to cPanel or use FTP/File Manager.
• Navigate to your site’s root directory (e.g., /public_html).

Step 2: Create or Edit .htaccess

1. If .htaccess already exists, open it for editing.
2. If not, create a new file named .htaccess.

Step 3: Add the Directive

Insert one of the following lines depending on your needs:

# Enable register_globals (not recommended)
php_flag register_globals On

# Disable register_globals (recommended)
php_flag register_globals Off

Step 4: Save and Verify

1. Save the .htaccess file.

2. Create a test file info.php with:

   <?php phpinfo(); ?>

3. Load it in your browser and search for register_globals.

4. Confirm whether it is enabled or disabled.

5. Delete the test file afterward for security.

Best Practices

• Always keep register_globals disabled to protect your application.
• Use superglobals ($_GET, $_POST, $_COOKIE) explicitly instead of relying on automatic variable creation.
• If you are running PHP 5.4 or later, this directive is no longer available.