register_globals still working, why?

Question

In my php.ini I have register_globals=Off

But still if I visit

`/testing/testing.php?abc=19`

then value of abc=19 is shown by using echo $_REQUEST['abc'].
Question is why still I can access value of abc variable?

Note: I am using XAMPP.

Answer 1

You are asking why you can give register_globals=Off and $_REQUEST['abc'] will be set. That's not relevant to how register_globals works.

register_globals sets a global variable with the name of the URL key. So in this case you could do echo $abc; and the code would work fine if register_globals was enabled and would cause an error if it was disabled.

$_REQUEST (like $_GET and $_POST) is a super-global, and will be available whatever setting you give.

Answer 2

even if off/on register_gloabls $_GET and $_POST will have parameters which are coming from request

when you set register_globals=On

request like http://www.example.com/?abc=1&temp=3

then php will create variable with name abc and temp and assigns value 1,3 respectively.