Mengatasi Masalah pada PHP dengan Register Globals Off

July 18, 2005

Mulai versi 4.3.X, secara default setting register_globals pada PHP diset ke Off. Tujuannya buat meningkatkan sekuritas. Akibatnya banyak juga perusahaan hosting yang mengeset (baca: membiarkan seperti default) register_globals = Off.Bayangkan aja kalo misalnya kita mempunyai aplikasi PHP yang dibuatuntuk environment register_globals=ON, makan waktu juga kalo buat mengedit sana-sininya.

Buat mengatasi masalah tersebut, coba pake tips ini:

Buat file script PHP yang isinya begini yang diambil dari paket Mambo.

PLAIN TEXT

PHP:

<?php
$raw = phpversion();
list($v_Upper,$v_Major,$v_Minor) = explode(".",$raw);
if (($v_Upper == 4 && $v_Major <1) || $v_Upper <4) {
$_FILES = $HTTP_POST_FILES;
$_ENV = $HTTP_ENV_VARS;
$_GET = $HTTP_GET_VARS;
$_POST = $HTTP_POST_VARS;
$_COOKIE = $HTTP_COOKIE_VARS;
$_SERVER = $HTTP_SERVER_VARS;
$_SESSION = $HTTP_SESSION_VARS;
$_FILES = $HTTP_POST_FILES;
}
if (!ini_get('register_globals')) {
while(list($key,$value)=each($_FILES)) $GLOBALS[$key]=$value;
while(list($key,$value)=each($_ENV)) $GLOBALS[$key]=$value;
while(list($key,$value)=each($_GET)) $GLOBALS[$key]=$value;
while(list($key,$value)=each($_POST)) $GLOBALS[$key]=$value;
while(list($key,$value)=each($_COOKIE)) $GLOBALS[$key]=$value;
while(list($key,$value)=each($_SERVER)) $GLOBALS[$key]=$value;
while(list($key,$value)=@each($_SESSION)) $GLOBALS[$key]=$value;
foreach($_FILES as $key => $value){
$GLOBALS[$key]=$_FILES[$key]['tmp_name'];
foreach($value as $ext => $value2){
$key2 = $key . '_' . $ext;
$GLOBALS[$key2] = $value2;
}
}
}
?>

Simpan file dengan ekstensi .php, misalnya globals.php

Kemudian include file tersebut pada setiap file yang dibuat untuk environtment register_globals=ON

PLAIN TEXT

PHP:

include ("globals.php");

Category Posted in PHP

12 Responses to “Mengatasi Masalah pada PHP dengan Register Globals Off”

Firman Wandayandi said on July 18, 2005, 6:03 pm:

Hihi, untung gua ga pernah coding dengan gaya register_globals=On, selalu off!

Tapi kayanya kerja rodi juga buat ngedit dari yang On ke Off.

Cheers!

maseko said on July 20, 2005, 7:57 pm:

Bener, bisa dianggep kerja rodi, palagi kalo scriptnya bukan coding sendiri..

deydi mokoginta said on December 7, 2005, 10:44 pm:

kalau trik diatas terlalu rumit

Coba terlebih dahulu membuat file .htaccess tempatkan di public_html:
Buat dengan kode:

php_value register_globals 1

File .htaccess merupakan extension jadi bukan nama file.
Buat menggunakan notepad lalu simpan dengan nama file
.htaccess
notepad akan membuat file:
.htaccess.txt

hapus tulisan .txt, anda bisa menghapusnya dengan program http://FTP.
upload dengan mode ASCII.

irene said on March 20, 2006, 4:20 pm:

Makasih banget nih maseko buat tipsnya, coding jadi gampang, tinggal masukkan langsung nama variabelnya, gak perlu make _POST atau _GET atau apalah itu

Websiteku juga jadi jalan dengan normal lagi hihi…

AGUNG WIRAPRAMANA said on August 16, 2006, 8:00 am:

Dear Maseko,
Bisa bantuin scripts untuk Register Global = OFF, saya perlu set Register Globals Off sementara Default setting server saya = On,.
Terimakasih, Saya tunggu yach

maseko said on August 16, 2006, 4:41 pm:

AGUNG WIRAPRAMANA, coba gunakan cara seperti yang diinformasikan deydi mokoginta pada komentar #3. Buat file .htaccess pada root direktori yang disetting. Kalo sudah ada file .htaccess, tinggal tambahkan barisnya

php_value register_globals 0

Muhal said on January 18, 2007, 4:01 pm:

Dear All, aku dah coba buat file .htacces dan tak upload di direktori publik html tapi sub domain-ku aja, tapi kok malah webku jadi rusak dg pesan Internal Server Error… Kira2 ada yang salah Thanks atas atensinya

maseko said on January 18, 2007, 5:16 pm:

Kemungkinan karena nggak ada permisi mengatur konfigurasi melalui .htaccess. Coba tanya ke admin servernya.

Rudi said on April 24, 2007, 12:47 am:

Saya minta tolong kepada siapa saja yg tahu masalah ini:
Saya punya script yang register globals on. Setelah saya upload di server mengalamai masalah, tetapi setelah saya register globals saya on-kan semua berjalan baik, kecuali satu file, yakni entry untuk registrasi.
Masalahnya koneksi dengan database MySQL, pertama kali ada entry masuk, dapat diterima dengan baik, tetapi untuk entry berikutnya tidak dapat masuk ke database, error memberitahu kalau terjadi double entry, padahal isian lain sama sekali. Ia minta untuk membebaskan entry yang sudah ada dulu, setelah entry pertama dihapus, script dapat memasukkan entry lagi, tetapi untuk entry berikutnya ditolak lagi.
Script selengkapnya berikut ini, tolong, bagian mana yang harus diupgrade:

———-
[quote]
$direct_sponsor,
‘random_sponsor’ => $random_sponsor,
‘title’ => “Registrasi” !
);
$error = “”;

// Proses data member :
if ($_POST) {
$error = “”;
if (!strlen($userid)) {
$error .= “Mohon diisi UserId yang anda inginkan.”;
}
if (strlen($userid) Mohon diisi UserId lebih dari 5 huruf.”;
}
if (strlen($userid) > 12) {
$error .= “Maksimum panjang UserId adalah 12 huruf.”;
}
if (ereg(’%', $userid) || ereg(’ ‘, $userid)) {
$error .= “UserId yang anda isikan tidak diterima/invalid.”;
}
if (!eregi(”^[_\.0-9a-z-]+$”, $userid)) {
$error .= “UserId yang anda isikan tidak diterima/invalid.”;
}
if (read_member($userid)) {
$error .= “UserId ‘$userid’ sudah digunakan, Silahkan pilih yang lain.”;
}
if (!check_email($email1)) {
$error .= “Mohon diisi email yang benar.”;
}

if ($email1 != $email2) {
$error .= “Mohon diisi email yang sama.”;
}
if (!strlen($password1)) {
$error .= “Mohon diisi password yang anda inginkan.”;
}
if ($password1 != $password2) {
$error .= “Mohon diisi password yang sama.”;
}

if (!strlen($name)) {
$error .= “Mohon diisi nama lengkap anda.”;
}
if (!$cek) {
$error .= “Anda harus menyetujui kebijakan program ini”;
}
if ($error) {
display_html($error, “error.html”);
}

$email = $email1;
$password = $password1;

//proses 3 angka unik untuk masing-masing biaya :
$unik = unik_number();

$dsponsor_amount = $conf['dsponsor_amount']+$unik;
$rsponsor_amount = $conf['rsponsor_amount']+$unik;
$admin_amount = $conf['admin_amount']+$unik;

//Masukin data member ke database members :
$dbq1 = “INSERT INTO members SET userid = ‘$userid’, password = ‘$password1′,email=’$email1′,
name = ‘$name’, phone = ‘$phone’, direct_sponsor = ‘$direct_sponsor’,
random_sponsor = ‘$random_sponsor’, payment = ‘$unik’, joindate = NOW()”;
$res = mysql_query($dbq1);

//Lihat konfigurasi email dari database :
$letters_row = mysql_fetch_array(
mysql_db_query($conf['dbname'], “SELECT * FROM letters”))
or display_html(mysql_error(), “error.html”);
$newuser_msg = $letters_row['newuser_msg'];
$direct_msg = $letters_row['dsponsor_msg'];
$random_msg = $letters_row['rsponsor_msg'];
$admin_msg = $letters_row['admin_msg'];
$user_title = $letters_row['user_title'];
$dsponsor_title = $letters_row['dsponsor_title'];
$rsponsor_title = $letters_row['rsponsor_title'];
$admin_title = $letters_row['admin_title'];

// Kirim email kepada user baru :
$msg = replace($newuser_msg);
sendmail($conf['admin_email'], $email, $user_title, $msg, ‘1′);

// Kirim email kepada direct sponsor :
$msg = replace($direct_msg);
$dsponsor_row = mysql_fetch_array(mysql_db_query($conf['dbname'], “SELECT email FROM members WHERE userid =’$direct_sponsor’”));
sendmail($conf['admin_email'], $dsponsor_row['email'], $dsponsor_title, $msg, ‘1′);

// Kirim email kepada random sponsor :
if ($conf['rsponsor'] == 1) {
$msg = replace($random_msg);
$rsponsor_row = mysql_fetch_array(mysql_db_query($conf['dbname'], “SELECT email FROM members WHERE userid =’$random_sponsor’”));
sendmail($conf['admin_email'], $rsponsor_row['email'], $rsponsor_title, $msg, ‘1′);
}

// Kirim email kepada admin :
$msg = replace($admin_msg);
sendmail($conf['admin_email'], $conf['admin_email'], $admin_title, $msg, ‘1′);

// Pendaftaran sukses, menampilkan halaman terima kasih
// Tampilkan halaman (template file : page_thanks.html)
display_home_page(”page_thanks.html”, $show_array);
exit;
}

// Tampilkan halaman (template file : page_join.html)
display_home_page(”page_join.html”, $show_array);

// Fungsi parse email :
function replace($str) {
global $conf, $userid, $dsponsor_amount, $rsponsor_amount, $admin_amount;
$msg = $str;

$member_row = mysql_fetch_array(
mysql_db_query($conf['dbname'], “SELECT * FROM members WHERE userid = ‘$userid’”))
or display_html(mysql_error(), “error.html”);
$dsponsor = $member_row['direct_sponsor'];

$dsponsor_row = mysql_fetch_array(
mysql_db_query($conf['dbname'], “SELECT name,userid,email,bank,phone FROM members WHERE userid =’$dsponsor’”))
or display_html(mysql_error(), “error.html”);

$msg = str_replace(”{member_name}”, $member_row['name'], $msg);
$msg = str_replace(”{member_email}”, $member_row['email'], $msg);
$msg = str_replace(”{member_phone}”, $member_row['phone'], $msg);
$msg = str_replace(”{member_userid}”, $member_row['userid'], $msg);
$msg = str_replace(”{member_password}”, $member_row['password'], $msg);

$msg = str_replace(”{dsponsor_name}”, $dsponsor_row['name'], $msg);
$msg = str_replace(”{dsponsor_phone}”, $dsponsor_row['phone'], $msg);
$msg = str_replace(”{dsponsor_email}”, $dsponsor_row['email'], $msg);
$msg = str_replace(”{dsponsor_bank}”, $dsponsor_row['bank'], $msg);
$msg = str_replace(”{dsponsor_amount}”, $dsponsor_amount, $msg);

if ($conf['rsponsor'] == 1) {
$rsponsor = $member_row['random_sponsor'];
$rsponsor_row = mysql_fetch_array(
mysql_db_query($conf['dbname'], “SELECT name,userid,email,bank,phone FROM members WHERE userid =’$rsponsor’”))
or display_html(mysql_error(), “error.html”);
$msg = str_replace(”{rsponsor_name}”, $rsponsor_row['name'], $msg);
$msg = str_replace(”{rsponsor_phone}”, $rsponsor_row['phone'], $msg);
$msg = str_replace(”{rsponsor_email}”, $rsponsor_row['email'], $msg);
$msg = str_replace(”{rsponsor_bank}”, $rsponsor_row['bank'], $msg);
$msg = str_replace(”{rsponsor_amount}”, $rsponsor_amount, $msg);
}

$msg = str_replace(”{admin_name}”, $conf['admin_name'], $msg);
$msg = str_replace(”{admin_phone}”, $conf['admin_phone'], $msg);
$msg = str_replace(”{admin_email}”, $conf['admin_email'], $msg);
$msg = str_replace(”{admin_bank}”, $conf['admin_bank'], $msg);
$msg = str_replace(”{admin_amount}”, $admin_amount, $msg);

$msg = str_replace(”{member_url}”, $conf['member_url'], $msg);
$msg = str_replace(”{program_name}”, $conf['program_name'], $msg);
$msg = str_replace(”{program_url}”, $conf['program_url'], $msg);

return $msg;

}

?>
[/QUOTE]
——–
Sebelumnya saya ucapkaan terima kasih.