Naming a global variable the same as a SESSION, GET or POST variable

[torvista]

you can safely remove the code.

So to be completely clear, all eight instances of

unset($GLOBALS[$key]); 

in

init_santize.php

can be commented out for the moment?

[mc12345678]

Hi

As suggested by other posters here, the code in init_sanitize that will unset certain $GLOBAL values was done for security reasons, and was meant to 'imitate' setting register_globals=off.

However register_globals was deprecated in php 5.3 and removed in php 5.4, so the benefit of the code in init_sanitize is moot.

If you are using php 5.4 and therefore sure that register_globals is no longer used, then you can safely remove the code.
In the short term and to make upgrading easier, you could use the overrides directory under the init_includes directory.

We will address this in v155.

So to be completely clear, all eight instances of

unset($GLOBALS[$key]); 

in

init_santize.php

can be commented out for the moment?

That's a method to accomplish what was said. The initial solution being to copy includes/init_includes/init_sanitize.php to includes/init_includes/overrides and then modify the file in that directory to eliminate the removal of the global variables when the equivalently named other type variable is passed...

It could maybe be misinterpreted to mean completely remove all content of init_sanitize.php, but I wouldn't go so far as that considering we were primarily focused on the unsettng of the global variables. But if the other actions imitate register_globals=off functionality then yeah, that/those sections also.

Just make sure your upgrade process includes review of the overrides folder at some point.