How To Disable PHP Register Globals -- Drupal Status Report

Ranked #3,259 in Computers & Electronics, #64,843 overall

Trying To Figure Out How To Get Rid Of That Annoying Warning From The Drupal Status Report?

So I'm comparing Drupal and Joomla on my test site. I want to learn both Content Management Systems (CMS), then decide which, if either, I'm going to use for my websites.

I'm not much for sitting down and reading page after page of documentation before digging into a system. It doesn't matter if it's hardware, or software, I'll only look at the documentation after I run into a problem.



Unfortunately, the problem with register globals is not actually something you can correct from within Drupal itself. If you need to disable register globals, you need to do it with your domain hosting files, or have your hosting company disable it for you.

Before contacting my hosting company, I decided to try to disable it myself, and here's how it turned out.

(Druplicon from Druplicon | drupal.org)

Welcome To Your New Drupal Website

One Or More Problems Were Detected With Your Drupal Installation

I had set up a subdomain to serve as my test site, and installed the current version of Drupal available from my hosting company.

Here was the first thing I noticed when I went to the admin screen after installing Drupal for the first time.

Status Report

Looking over the Status Report, I notice two problems. The first one has to do with updates, and this sounds familiar to me. Whenever I start up a new computer, the Operating System usually needs to be updated.

The second problem is with PHP register globals, which is a new term for me that I know nothing about.

I decide to tackle the easier looking problem first, and see if the problem with PHP register globals is also taken care of.

The recommendation is to run "cron" or check manually. I wasn't familiar with cron, but a little research told me that it is a Linux term. Cron is a program that can be scheduled to automatically run commands and scripts.

In this case, I need cron to look for available updates for my Drupal install.

There is a security update available for your version of Drupal

After running cron, I discover that there are some updates available,

"There is a security update available for your version of Drupal. To insure the security of your server, you should update immediately! See the available updates page for more information."

The problem with PHP register globals also indicates a security risk, so I'm more hopeful that installing the updates will take care of both problems.

Available Updates - Drupal Core

Security update required!

As far as I can see, the updates need to be installed manually by me, so I download the zipped files to my own computer. I make a new directory in my Drupal install using the file manager with my hosting company's cPanel -- cPanel is another Linux term, it is basically a way for me to access the files of my hosted website with a browser on my own computer.

I unpack the zip file, and I'm ready to go.

Drupal: Site Off-Line

Oh no! I locked myself out!

Even though my site isn't likely to be getting any visitors, I decided to set it to maintenance mode before installing the updates.

I logged out, then tried to get back into my site, and faced a screen with no obvious way to log back in.

Luckily, the solution is to just manually add "user" to the address in the address bar, this brings me to a login screen.

Updating Drupal

Upgrading is as easy as backing up your existing files, so you can delete the ones in your main directory, and replace them with the files from the zip archive.

The .htaccess file may need to be copied from your backup, you'll also need sites/default/settings.php, the 'files' directory, any subdomain folders, or any other custom files like cron scripts in scripts/ or customized themes within sites/all/themes/custom/.

Since my site is new, I didn't have many of these files to copy over. You really should read Upgrading from previous versions before attempting an upgrade.

Database Updates - Out Of Date

PHP register globals still enabled

"Some modules have database schema updates to install. You should run the database update script immediately."

I wasn't exactly sure what this meant, but I could see that my PHP register globals still hadn't been taken care of and now I have two red warnings!

I followed the advisory from the Database Updates line first

Drupal Database Update

Running the database update appeared to make sure the information I had copied over from my old site were compatible with the updates I had just installed.

Drupal Core Update Status

After the database update, I was back to one yellow exclamation point and one red warning.

The Drupal core update status line was now an issue, and the PHP register globals problem still wasn't corrected.

Time to run cron again

Cron Ran Successfully

Drupal core update status - Up to date

I ran cron again, which verified that there were no more updates needed.

I was finally down to just one issue, but it was this persistent PHP register globals issue. None of the other problems appear to have been related to it.

Now I start looking at the actually recommendation in the warning. I follow the link to the PHP manual, and learn enough to see that PHP register globals is set outside of Drupal.

One of the first areas I'm directed to is the .htaccess file, a file I know a little about. It is a configuration file that is located in the root of your web directory. It is often used for Authorization/Authentication, Cache Control, Customized Error Responses (like "HTTP 404 Not Found") and Rewriting URLs.

(For more information about .htaccess look at: .htaccess Tutorial)

Looking At .htaccess

PHP 4 & PHP 5

I looked at the .htaccess file in the directory for the subdomain I had installed Drupal in, and did find three references to PHP register globals.

It was set to "0" on all three lines, which should mean I was all set, or at least that's what I thought from what I had read so far.

Time to dig some more.

php.ini - The Missing File

Create New File



I did find reference to a configuration file other than .htaccess that appeared to be specifically for PHP, and I did not have one of those.

That file is "php.ini" and since it was missing from my directory, I decided to make it.

Note: If you are using PHP 5 with an account hosted on GoDaddy, you may need to name this file "php5.ini"!

register_globals = Off

Based on a post on the Drupal support forums, register_globals is enabled, I wrote this very simple file, and tried it out.

Drupal Is Now Ready To Go!

Status Report - All Green Check Marks!

This looks like what I want. No more exclamation marks or red warnings!

I'm actually glad this happened, since it exposed me to how my installations interact with my web host's settings. It also prepared me for the future when, if I continue to use Drupal, I may need to update a live site.

Of course, I'll test any changes I make on a duplicate test site before actually working on a live site.

This worked for the hosting company that I use, but I can't say for sure what other companies it will work with. Considering how easy it turned out to be, I'm glad I tried it before bothering tech support about it,

I did glean some some information from my hosting company's support forums, and may have actually found the solution there, if I had spent more time sifting through the information. Otherwise, I would have posted in the forums asking for help before calling support if this hadn't worked.

Now I'm ready to start building!

Drupal News from Dries Buytaert

Loading Fetching RSS feed... please stand by
Support | drupal.org
Get started
Get up and running building your site with Drupal: Start here

Get Documentation
Find answers to your questions in the handbooks

Get Help
Help, meet, chat, discuss, and learn even more in the forums

Building a Blog?

This intense workshop can help you make it better


Learn From the Pro
Build a Better Blog Course
Click Here!




Register for SES London Today


Register and Save 15% on SES New York Today

Comments? Let Me Know What You Think!

submit

Enjoy This Lens On How To Disable PHP Register Globals?

If you would like to rate it, please do so here (Squidoo members only)


Not a member?
Join Me!

This module only appears with actual data when viewed on a live lens. The favorite and lensroll options will appear on a live lens if the viewer is a member of Squidoo and logged in.

Add this to your lens »

About CleanerLife

SquidooMusic Blog



Freelance Web Developer and content provider.

Lensmaster with over 100 pages of content on Squidoo.

Webmaster for Careers Resources, Live Success and All This and More.

I'm addicted to the Internet, I'm also an information and entertainment junkie.

I'm obsessed with eating healthy, fresh food raised or grown as local as possible, reducing pollution, increasing recycling, and using natural products in and around the home.

Careers Resources


↑ Grab this Headline Animator

Loading

CleanerLife's Top 10

Loading Fetching RSS feed... please stand by

free counters



Drupal is a registered trademark of Dries Buytaert.

Original content:

Creative Commons License
How To Disable PHP Register Globals
by CleanerLife
is licensed under a Creative Commons
Attribution-Noncommercial-No Derivative Works 3.0
United States License
.

by

CleanerLife

Lensmaster, Webmaster, I'm addicted to the Internet. I'm an information and entertainment junkie.
I'm obsessed with eating healthy, fresh food raised...
more »

Feeling creative? Create a Lens!