session global from On to Off

I want to fix it after i switched it off!

[smagdy]

Hello,

I built my site while globals were On but its just like 4 pages that use sessions so i can fix them but i didnt understand the idea of globals on or off but i understand that for security it should be off and i saw some examples of why it should be off!

I am using PHP 5.2
When i turned globals off i got that warning Your script possibly relies on a session side-effect which existed until PHP 4.2.3. Please be advised that the session extension does not consider global variables as a source of data, unless register_globals is enabled. You can disable this functionality and this warning by setting session.bug_compat_42 or session.bug_compat_warn to off, respectively."

But i managed to stop the warning but the sessions stopped working!

So now i create my sessions like this so what wrong or how it should be so they work fine?

if (!session_is_registered("newAdVars"))
session_register("newAdVars");

foreach($HTTP_POST_VARS as $varname => $value)
{
$newAdVars[$varname] = trim($value);
}

Thanks in advance

[joelgreen]

Few tips:
- use $_POST instead of $HTTP_POST_VARS (same goes for $_GET)
- if you had register_globals turned on before then you can use extract php function at the script start to simulate that behavior.
Like extract($_POST); extract($_GET); extract($_COOKIE); etc. You could also use extract($_REQUEST) to extract from all these arrays at once. It would extract variables to the local namespace, so you will be able to access them without code change.

Example:
if $_POST is array("aaa" => "111", "bbb" => "222");
extract($_POST) would create two variables named "aaa" and "bbb" with corresponding values.

Cannot understand the newAdVars logic :(

[coopster]

Yep, you are using some deprecated variables and functions here. I don't use session_is_registered [php.net] (see the Caution on that page for reason why). If you want to know if a variable exists in your session, use the isset() [php.net] function instead. And, as recommended here, stop using HTTP_*_VARS and start using the superglobals [php.net].