[CLUE-Tech] Apace/PHP Brain-Cramp on HTTP_REFERER?

[Garey Hoffman]

Jed,

Are you using the latest version of PHP? If so, then the following bit of 
information could help you out:


PHP has recently gone through quite a bit of changes regarding how certain 
variables are made available. The bottom line is the development team felt 
it was necessary from a security standpoint (and I personally think they 
made a wise decision). Beginning with PHP version 4.1.2, the default 
behavior of the PHP installation is to use a new syntax for calling 
standard CGI variables and other user-submitted variables. This behavior 
was introduced in PHP version 4.1.0 but the default behavior was the style 
that you were used to using up until this latest release.

You can 'turn off' this new behavior and use the old style syntax by 
reading up here:

http://www.php.net/manual/en/security.registerglobals.php


You can find out more fromthe FAQ here:

http://www.php.net/manual/en/faq.using.php#faq.using.cgi-vars

Content from above URL pasted here:

-----
12. I'm trying to access one of the standard CGI variables (such as 
$DOCUMENT_ROOT or $HTTP_REFERER) in a user-defined function, and it can't 
seem to find it. What's wrong?
Environment variables are normal global variables, so you must either 
declare them as global variables in your function (by using "global 
$DOCUMENT_ROOT;", for example) or by using the global variable array (ie, 
"$GLOBALS["DOCUMENT_ROOT"]".
-----


If there are any other PHP users out there who are not aware of this recent 
change, I suggest you read up on it. A bit of knowledge could save you 
quite a bit of anguish and frustration.


HTH.


---Garey



At 13:29 4/9/2002 -0600, Jed S. Baer wrote:
>Well, a bit of reading on the PHP and Apache websites is telling me that
>$HTTP_REFERER should be available to me as a "normal" global. Looking at
>example scripts, I see it used.
>
>However, using the <?phpinfo()?> script, I see nothing by that name, not
>even as an element in $_although register_globals is on in php.ini.
>
>I will note that my reference is inside a function, where it is declared
>as a global. ($HTTP_POST_VARS doesn't work either, inside the function,
>BTW). And yes, I did spell it the proper incorrect way ;-). The php FAQ
>page specifically mentions these "CGI environment" variables, and from
>what I could find on the Apache site, HTTP_REFERER is a standard for
>Apache.
>
>So, what am I missing? This is Apache 1.3 and PHP 4.1
>
>Thanks,
>jed
>
>--
>Fight the CBDTPA: http://www.eff.org/alerts/20020322_eff_cbdtpa_alert.html
>
>"Those who expect to reap the blessings of freedom must, like men,
>  undergo the fatigue of supporting it." - Thomas Paine
>_______________________________________________
>CLUE-Tech mailing list
>CLUE-Tech at clue.denver.co.us
>http://clue.denver.co.us/mailman/listinfo/clue-tech