register_globals more or less takes data from a variety of named sources and combines all of it to be available in the global variable namespace. Data from HTML forms, server and enviornment variables, data from cookies and sessions.
If an HTML form has a method of POST and contains the following field:
<input type='text' name='some_variable' value='Hello, World!' />
With register_globals = On it is available in PHP as:
$some_variable
With register_globals = Off it is available in PHP as:
$_POST['some_variable']
Its an indice inside of the $_POST array instead of a normal global. This is a good thing since in the following scenario, you wouldn't be able to tell if $some_variable came from GET, POST, etc.
Using the same HTML form with a GET method:
With register_globals = On it is available in PHP as:
$some_variable
With register_globals = Off it is available in PHP as:
$_GET['some_variable']
Do you see why there are problems with it being on?
Anyhow have a look at Nik's FAQ which discusses this more in depth.
http://p2p.wrox.com/archive/beginnin...2002-11/17.asp
hth,
Rich
::::::::::::::::::::::::::::::::::::::::::
The Spicy Peanut Project
http://www.spicypeanut.net
::::::::::::::::::::::::::::::::::::::::::