How to turn off register_globals
This issue came up during my first Drupal installation attempt. Drupal won’t actually install if you have register_globals turned on. If you have this problem, here’s how to fix it.
Step 1 - Is PHP running as an Apache module or as CGI?
This is straight forward. In fact, the whole guide is, but this step more so.
Create a new file called phpinfo.php. If you’re using this guide to troubleshoot a Drupal installation, you will want to place the file in the same directory as Drupal in order to ensure that the results are accurate.
Inside this file, place the following code:
<?php phpinfo(); ?>
Now run the file by aiming your browser at http://www.yoursite.com/phpinfo.php
Near the top of the file, next to ”Server API” you will see either “CGI” or “Apache“.
You’ll want to delete the phpinfo.phpfile so as to prevent looky loos from getting information about your server configuration but, if PHP is running as CGI, you’ll need it in a moment, so don’t delete it quite yet (those of you with PHP running as an Apache module can go ahead and delete it now).
Step 2 - Fix it! (think Oscar Rogers/SNL… good times… back to the guide)
If in the last step you learned that PHP was running as an Apache module, then:
Add this line to your .htaccess file:
php_flag register_globals 0
If you have a very low end hosting package, this may not work as your host might have restrictions on what you are able to accomplish through .htaccess edits. If this is the case, get on the phone to your host and kindly ask them to consider turning register_globals off… or consider changing hosts.
That’s all for the Apache group!
If in the last step you learned that PHP was running as CGI, then:
Aim your browser back to your phpinfo.php file and look for the row that shows you the path to the php.ini file. If you can access this file then add then open it up and add the following line:
register_globals = off
If you can’t access the file, or were unable to edit it for whatever reason, be hopeful that your host has enabled the use of custom php.ini files and try the following:
Create a file called php.ini(again, if this is being done for a Drupal installation, make sure that the file is created in the same directory as Drupal) and add the following line of code:
register_globals = off
Step 3 - Copy the original php.ini file (you can skip this step if you were able to edit an existing php.ini file in step 2).
If making a new php.ini file in step 2 resolved your issue, then you’ll want to make a copy of the original php.inifile so that you’re not inadvertently changing settings that you shouldn’t be.
For this step, you’ll need two pieces of information: The path to the original php.ini file, and the path for your new copy. The current path can be obtained by aiming your browser back at that phpinfo.php file; the php.ini path will be displayed in one of the rows (it usually starts with /usr/local/…).
Create a new file called copyini.php and insert the following code:
<?php system("cp /usr/local/lib/php.ini /home/YOU/php.ini"); ?>
In the above code snippet, be sure to replace /usr/local/lib/with whatever showed in the results of your php.ini file, and /home/YOU/ with your target directory. don’t forget to include php.ini on the end of both paths.
Aim your browser at this file. It will produce a blank screen, but it will have placed a copy of the original php.ini file into your target directory. Open up that copy and search for the line register_globals and turn it off.
The last step is to once again address those looky loos. Open your .htaccessfile and add the following code snipet:
<Files php.ini> order allow,deny deny from all </Files>
That will keep them from looking at your php.ini file.
I hope that helps!








