Custom global variable

Question

In that question here, I explained that I was afraid to save my settings in the variable $GLOBALS because she turns my settings into global values, then the guy answered me that there was no problem, and then asked me by the comments if they were global like.

I created this example to explain how I record the values and how I catch them, and then maybe someone here can answer me if I should avoid using it or not. I also don’t know if the question is the same as the one I asked yesterday, but I hope.

Right now I’m setting my variable like this:

$GLOBALS['configuracao'] = array(
    'banco'=>array(
        'nome'=>'proj3439',
        'tabela'=>'usuarios'
    ),
    'sessao'=>array(
        'tempo'=>24,
        'nomeSessao'=>'testeS'
    )
);

Ai if your try to print its value on the screen, it presents me the name and values of all type global variables SERVER_ADDR, POST and others.

Now, if I put the name of my configuration with the variable symbol and try to print its value on the screen, it returns me the values I set before.

$GLOBALS['_CONFIG'] = array(
    'banco'=>array(
        'nome'=>'proj3439',
        'tabela'=>'usuarios'
    ),
    'sessao'=>array(
        'tempo'=>24,
        'nomeSessao'=>'testeS'
    )
);

If I try to read the value of this setting there the same way I do with the POST, it will show me the values I put in the variable:

print_r($_CONFIG);

Then I also realized that if I create a variable and put a value on it, it goes right into the variable $GLOBALS.

$configuracao = "proj3439";

These settings I put up there only appear when I start the script that defines them, I always call that script so I have my settings always loaded. When they are started I can use them anywhere in my script, even within classes and functions, it looks like a normal variable, but only that I defined it directly in the $GLOBALS.

Have any problem setting my settings the moment I run the script or even in that variable?

The people can forge data that comes through $_GET which is also a global one, and I ended up creating a similar global one. I will have security problems?

Answer 1

The problem of using global variables implicitly is not great, only that you lose the perspective that is dealing with global.

Have you seen the other questions that global is not something to be abused, to use where you really need to global state. It’s easy to confuse things when dealing with global, but there are cases to use.

So while you can access the variable directly avoid doing this, create an always access global convention explicitly saying that they are global.

There are two ways to do this. By array associative $GLOBALS or by the keyword global. Doing for any of them will be solving a possible problem of scope.

$GLOBALS X global

There was no difference, but it seems in version 5.4 started getting better using the keyword global than the variable $GLOBALS. Semantically it gives in but there is a small gain using the keyword. Nothing that will significantly change the performance but it is a gain.

When you call the variable $GLOBALS for the first time PHP has to take the name of all global and popular the $GLOBALS with them, creating the members of the array, because it only exists as a variable when used.

Security

The $GLOBALS will be used no matter what syntax you use. And it is safe on the server. Actually $_GET and $_POST also are. The insecurity you hear about is the data that will be sent to these variables (which are also global). You have no control over data coming from outside the server, but when they’re inside they’re safe.

In the case of what’s in $GLOBALS you have total control over the content that is there, no need to worry. What is in the $_GET You don’t know what came out, so they say you have to validate the content. The problem is not the variable being global, but where the content comes from, they are different things.

Before using any language feature be sure to read the documentation and do as you are doing, ask before using, whenever you have questions.