Here's my issue - a friend's hosting expired and I offered to host it - on moving it to my server, nothing worked (see http://nordconsultants.com). After looking at the code, I found the issue.
to explain what's going on, PHP used to have register_globals turned on by default. It was turned "off" in version 4.2, deprecated in 5.3, and was removed in version 5.4.
Basically, it "read" all of the indexes from the superglobals ($_GET, $_POST, etc.) and magically created $variables with them. This made things marginally easier for coders -novice coders, at least- but was a huge security problem otherwise. For example (from php.net):
<?php // define $authorized = true only if user is authenticated if (authenticated_user()) { $authorized = true; }
// Because we didn't first initialize $authorized as false, this might be // defined through register_globals, like from GET auth.php?authorized=1 // So, anyone can be seen as authenticated! if ($authorized) { include "/highly/sensitive/data.php"; } ?>
I would be suspicious that a script written so long ago (when code like this was common) would have other security problems with it. For example, you should _never_ use user-submitted data without checking that it is valid and safe. I would highly recommend checking.
When you click on a menu item, say "about us", it is supposed to load copy-about.txt. Unfortunately, my server is set up differently and is not a valid path. The .txt files are in the same directory as the PHP file.
I tried:
and nothing worked. I'm guessing I am just missing something stupid, but I am out of ideas. Anyone? Thanks in advance.
that last line should read
Still no dice. PHP is up to date (5.3.10). Not sure what's going on here...
register_globalsturned on by default. It was turned "off" in version 4.2, deprecated in 5.3, and was removed in version 5.4.Basically, it "read" all of the indexes from the superglobals ($_GET, $_POST, etc.) and magically created $variables with them. This made things marginally easier for coders -novice coders, at least- but was a huge security problem otherwise. For example (from php.net):
I would be suspicious that a script written so long ago (when code like this was common) would have other security problems with it. For example, you should _never_ use user-submitted data without checking that it is valid and safe. I would highly recommend checking.