yintercept's Journal: Less Secure

My web host upgraded some of the programs on my account. During this change, they toggled the Magic Quotes settings on the account. That meant that I started getting the dreaded \"slash effect\" for all the quotes and apostrophes used on the page.

Of course, had things toggled the other way. I would have been in a much worse shape. If I had programmed with the expectation that magic quotes were on, and the magic disappeared, I would be having crashing SQL queries and would be suffering from an exposed system.

To be a good PHP programmer, one has to design the system so that it can handle both settings. Since PHP is a scripted language, this type of garbage wastes a lot of computer resources. This is why I am so angry with PHP's decision to add MAGICQUOTES.

The register globals issue has similar problems. The reason register globals was a security issue is that PHP programmers are often sloppy when initializing variables. A web site that has register globals off is slightly more secure than one with it on.

Problems arise when sloppy coders write with the assumption that register globals is off. A foolish program who writes as if register globals off were a security feature is more likely to deliver buggy code than one who knows that uninitialized variables are the security hole. A program that depends on RG Off for security will become insecure the moment that an network admin turns RG On.

The following code might appear in a program written with the expectation that RG is off:

if ($_POST['button'] == 'Login') {
if ($_POST['password'] == 'theITguyRules!') {
$access = 1;
} else {
$access = 0;
}
}
if ($access == 1) {
echo 'The company bank account is '.$account;
echo 'There is '.$balance.' dollars ready for transfer.';
}

Since register globals is off, the IT guy would not catch the fact that he failed to initialize $access. The code is secure with RG On, but is insecure with it off.

The security hole is not register globals, but the fact that the programmerr failed to initialize variables. RG Off helps protect from bad programming.

The RG toggle is easier to deal with than MagicQuotes. If you code as if RG were off and initialized all variables, your code would work for both settings. It also makes checking for unitialized variables easier.

Anyway, I am going to waste a whole day recoding a site so that it can handle the different settings of Magic Quotes. The end result of my day's work will be a site that is just a little bit slower than it was before.