Hacker News Reader

register globals didn't "make undeclared variables act like empty strings".

register globals imported request parameters from the query string and post body into the global variable scope.

having undeclared variables "act like empty strings" is related to non-strict variable comparison (== vs ===) and either silencing errors, or not displaying/caring about them.

View on HN

register_globals could not have existed without the legality of undeclared variables, and it could not have been a security issue without code that relied on using undefinedness as a default value.

undeclared variabels aren't legal, they cause errors. if your php is configured to ignore those errors thats on you.

of course it could be a security issue without undefined variables coercing to an empty string in string context - it could allow request parameters to override defined variables.

Reply on news.ycombinator.com