Strange Variable Passing Problem

[honey]

I have a php page to which I pass a variable like:

www.domain.com/test.php?id=1

Now, the file test.php includes nothing but

<?
include("config.php");
header("Location: http://www.redirect.com/main.php?domainID=$id");
?>

technically, this should work, and it does. The problem is that it works on one hosting company, not the other. Now, there is a problem somewhere. Can anybuide help me/guide me and tell me what I should ask/tell to my hosting company so that this works.

[exam]

For that to work, you need "register_globals" on in php. To fix it, use the $_GET super global variable.
<?
header( 'Location: http://www.redirect.com/main.php?domainID='.$_GET['id']."\n");
exit;
?> Note that according to the HTTP spec, the Location header needs a newline char at the end. (but most browsers accept it anyway.)
Also, after the header call, you can add an exit or die, so php exits immediatly.

[honey]

Thanks a ton exam. I really appreciate your time and effort. It did solve the problem. Can you shoot me your paypal ID, for a small donation I would like to send as a thank you for your time.

[samsam]

Honey, add the following in your .htaccess and you should be fine too.
Your version of php has register_globals turned off, so you can turn it on just by adding this in your .htacces.

php_flag register_globals on

I hope that helps.

[exam]

Except that it's not a very recommendable practice to have register_globals turned on. :) But that is a life saver especially when you're dealing with legacy php code that relies on register_globals, until you can get the code updated.

[samsam]

exam, can you please guide why "Except that it's not a very recommendable practice to have register_globals turned on.". I have it on.

[adstracker]

Because it's not safe. Anyone can manipulate variables within their script with the address bar.
This can lead to SQL injection if you using sql or other nasty things such as your script getting read or deleted. ( Depends on how your script looks like ).
I would definitely turn it OFF.

[exam]

Actually, there's nothing unsafe about having register_globals "on" if you *always* initialize variables before using them. BUT, There is a lot of old code out there that doesn't initialize variables before using them, plus, why clutter up the global namespace with a bunch of unneeded variable and as adstracker says, allow anyone to set variables in your script using the address bar.

[sketch]

All the reasons adstracker stated are why PHP has been released with register_globals OFF by default for a while now... and also why the .htaccess trick might not work depending on how your web host has set things up.

[neroux]

Perhaps the most controversial change in PHP is when the default value for the PHP directive register_globals went from ON to OFF in PHP 4.2.0. Reliance on this directive was quite common and many people didn't even know it existed and assumed it's just how PHP works. This page will explain how one can write insecure code with this directive but keep in mind that the directive itself isn't insecure but rather it's the misuse of it.

When on, register_globals will inject your scripts with all sorts of variables, like request variables from HTML forms. This coupled with the fact that PHP doesn't require variable initialization means writing insecure code is that much easier. It was a difficult decision, but the PHP community decided to disable this directive by default. When on, people use variables yet really don't know for sure where they come from and can only assume. Internal variables that are defined in the script itself get mixed up with request data sent by users and disabling register_globals changes this.

http://www.php.net/manual/en/security.globals.php