register_globals was a PHP setting that automatically converted URL parameters and form data into global variables. It was removed entirely in PHP 5.4 (released in 2012) due to serious security risks. If you are seeing errors about register_globals, your code needs to be updated.
register_globals no longer exists in modern PHP
This directive was deprecated in PHP 5.3 and completely removed in PHP 5.4. All current PHP versions on our servers (PHP 7.x and 8.x) do not support it. If your script requires register_globals, it needs to be updated to use $_GET, $_POST, $_REQUEST, or $_SESSION instead.
01. How to Update Your Code
Scripts that relied on register_globals used bare variable names like $username instead of $_POST['username']. To fix this, replace global variable references with the appropriate superglobal array:
// Old code (register_globals ON):
echo $username;
// Updated code:
echo $_POST['username']; // For form POST data
echo $_GET['username']; // For URL parameters
echo $_REQUEST['username']; // For either POST or GET
echo $_SESSION['username']; // For session data02. If This Is a Third-Party Application
If you are running an older application (CMS, forum, shopping cart) that requires register_globals, you need to update to a current version of that software. Any application that still requires register_globals has not been maintained since at least 2012 and almost certainly has unpatched security vulnerabilities.
If no update is available, the application has been abandoned and you should migrate to a supported alternative. For CMS options, see How to Install WordPress or Shopping Cart Software.
Do not attempt to re-enable register_globals or use workarounds like extract($_REQUEST). These create the same security vulnerabilities that led to register_globals being removed. The proper fix is to update the code to use superglobal arrays.
Need Help Updating Old Code?
If you need assistance migrating an older application to a current version, our team can help.
Open a Support TicketFrequently Asked Questions
Can I turn register_globals on?
No. register_globals was removed entirely in PHP 5.4 back in 2012 because it was a serious security risk, so there is no setting to enable on any current PHP version. Code that depends on it must be updated.
How do I fix code that needs register_globals?
Update the code to read input explicitly from $_GET, $_POST, $_REQUEST, and $_SERVER instead of relying on auto-created globals. This is the correct, secure pattern and the only option on modern PHP.
What if a third-party application needs register_globals?
The application is badly outdated and insecure. Update it to a current version that supports modern PHP, or replace it. Running software that still expects register_globals is a security liability even if it could be made to work.
Why was register_globals removed?
Because it let URL and form data overwrite arbitrary variables in a script, which attackers abused to inject values and bypass logic. Removing it closed a large class of vulnerabilities, which is why it cannot be re-enabled.
Quick Recap
- register_globals was removed in PHP 5.4 (2012)
- Cannot be re-enabled on modern PHP versions
- Replace bare variables with $_GET, $_POST, $_REQUEST, or $_SESSION
- Update third-party apps to current versions
- Do not use extract($_REQUEST) as a workaround
PHP compatibility guidance · Last updated November 2026 · Browse all PHP/MySQL articles
