How To Disable PHP Register Globals -- Drupal Status Report

I had set up a subdomain to serve as my test site, and installed the current version of Drupal available from my hosting company.

Here was the first thing I noticed when I went to the admin screen after installing Drupal for the first time.

Looking over the Status Report, I notice two problems. The first one has to do with updates, and this sounds familiar to me. Whenever I start up a new computer, the Operating System usually needs to be updated.

The second problem is with PHP register globals, which is a new term for me that I know nothing about.

I decide to tackle the easier looking problem first, and see if the problem with PHP register globals is also taken care of.

The recommendation is to run "cron" or check manually. I wasn't familiar with cron, but a little research told me that it is a Linux term. Cron is a program that can be scheduled to automatically run commands and scripts.

In this case, I need cron to look for available updates for my Drupal install.

After running cron, I discover that there are some updates available,

"There is a security update available for your version of Drupal. To insure the security of your server, you should update immediately! See the available updates page for more information."

The problem with PHP register globals also indicates a security risk, so I'm more hopeful that installing the updates will take care of both problems.

As far as I can see, the updates need to be installed manually by me, so I download the zipped files to my own computer. I make a new directory in my Drupal install using the file manager with my hosting company's cPanel -- cPanel is another Linux term, it is basically a way for me to access the files of my hosted website with a browser on my own computer.

I unpack the zip file, and I'm ready to go.

Even though my site isn't likely to be getting any visitors, I decided to set it to maintenance mode before installing the updates.

I logged out, then tried to get back into my site, and faced a screen with no obvious way to log back in.

Luckily, the solution is to just manually add "user" to the address in the address bar, this brings me to a login screen.

Upgrading is as easy as backing up your existing files, so you can delete the ones in your main directory, and replace them with the files from the zip archive.

The .htaccess file may need to be copied from your backup, you'll also need sites/default/settings.php, the 'files' directory, any subdomain folders, or any other custom files like cron scripts in scripts/ or customized themes within sites/all/themes/custom/.

Since my site is new, I didn't have many of these files to copy over. You really should read Upgrading from previous versions before attempting an upgrade.

"Some modules have database schema updates to install. You should run the database update script immediately."

I wasn't exactly sure what this meant, but I could see that my PHP register globals still hadn't been taken care of and now I have two red warnings!

I followed the advisory from the Database Updates line first

Running the database update appeared to make sure the information I had copied over from my old site were compatible with the updates I had just installed.

After the database update, I was back to one yellow exclamation point and one red warning.

The Drupal core update status line was now an issue, and the PHP register globals problem still wasn't corrected.

Time to run cron again

I ran cron again, which verified that there were no more updates needed.

I was finally down to just one issue, but it was this persistent PHP register globals issue. None of the other problems appear to have been related to it.

Now I start looking at the actually recommendation in the warning. I follow the link to the PHP manual, and learn enough to see that PHP register globals is set outside of Drupal.

One of the first areas I'm directed to is the .htaccess file, a file I know a little about. It is a configuration file that is located in the root of your web directory. It is often used for Authorization/Authentication, Cache Control, Customized Error Responses (like "HTTP 404 Not Found") and Rewriting URLs.

(For more information about .htaccess look at: .htaccess Tutorial)

I looked at the .htaccess file in the directory for the subdomain I had installed Drupal in, and did find three references to PHP register globals.

It was set to "0" on all three lines, which should mean I was all set, or at least that's what I thought from what I had read so far.

Time to dig some more.

I did find reference to a configuration file other than .htaccess that appeared to be specifically for PHP, and I did not have one of those.

That file is "php.ini" and since it was missing from my directory, I decided to make it.

Note: If you are using PHP 5 with an account hosted on GoDaddy, you may need to name this file "php5.ini"!

Based on a post on the Drupal support forums, register_globals is enabled, I wrote this very simple file, and tried it out.

This looks like what I want. No more exclamation marks or red warnings!

I'm actually glad this happened, since it exposed me to how my installations interact with my web host's settings. It also prepared me for the future when, if I continue to use Drupal, I may need to update a live site.

Of course, I'll test any changes I make on a duplicate test site before actually working on a live site.

This worked for the hosting company that I use, but I can't say for sure what other companies it will work with. Considering how easy it turned out to be, I'm glad I tried it before bothering tech support about it,

I did glean some some information from my hosting company's support forums, and may have actually found the solution there, if I had spent more time sifting through the information. Otherwise, I would have posted in the forums asking for help before calling support if this hadn't worked.

Now I'm ready to start building!

Learn From the Pro

Click Here!

Drupal is a registered trademark of Dries Buytaert.

Original content:


How To Disable PHP Register Globals
by CleanerLife
is licensed under a Creative Commons
Attribution-Noncommercial-No Derivative Works 3.0
United States License.