How do you come to the conclusion that it was because register_globals was turned on?

There's not even a valid reason to turn that setting on, with legacy not even being an excuse.