What is the best way to prevent users spoofing internal values in a PHP application by passing said variables in the URL?

Answer

You will want to set Register Globals to OFF
This can be done through the php.ini file, or if you do not own the server through a .htaccess file.

In the htaccess file put:
php_value register_globals 0

If you want the functionality of register globals without the security holes, then if you are reading values from sessions or cookies, use the Superglobal reference i.e.:
$_SESSION['username']
$_COOKIE['grant_access']

First answer by ID407871306. Last edit by ID407871306. Question popularity: 18 [recommend question]