Mdthbs

I get the impression that it is a programming best practice to create variables in specific scopes (like a function scope) and avoid global scope to make things more modular and better organized. However I'm not sure if there is also a security issue.

Here is an example of global variables in Bash that worked for me fine more than a year:

cat <<-EOF >> "$HOME"/.profile

    set -x

    complete -r

    export war="/var/www/html" # Web Application Root;

    export dmp="phpminiadmin" # Database Management Program;

    export -f war

    war() {

        cd $war/

    }

EOF



source "$HOME"/.profile 2>/dev/null

I have never had a problem with global variables in Bash or JavaScript, most likely because I only write small scripts for personal usage on minimalist environments.

Why do many programmers avoid using global variables?
Are there any examples of security breaches caused by using global variables?

Boycott Globals!

I'm stealing from @Steffen Ullrich's comment, but the main issue with global variables is that they make it difficult to keep code well organized and maintainable. His link is a fine one, but you won't have any trouble finding countless articles about the problems with global variables online.

When you use global variables, it becomes easy to lose track of where in your program the variable gets modified, especially if you don't have a simple linear flow. As a result global variables can work perfectly fine in small scripts, but can cause massive headaches as an application begins to scale. This might leave you with the impression that it is fine in very small applications, but since applications usually only grow over time, and things that start of temporary become permanent, it's really just a bad idea to use them at all. Why start on the wrong foot, when it is so easy to use properly scoped variables?

Security

Using global variables doesn't have any direct implications for security, but they do make it easier to end up with security issues:

If one loses track of where its data comes from and modifies a function in file A but forgets that the utilized variable comes from user input in file B, it might end up doing insecure things on user input without proper safe guards.

Technically this is possible in any application, but global variables can certainly make it easier.

Global Variables == Death

I don't know of any breaches that happened specifically because of global variables, but it's easy to argue that the use of global variables has literally killed people, so I think it's reasonable to just never use them.

Please compare the following pieces of code:

1)

/file.php:

    $newconn = new PDO('mysql:host=localhost;charset=utf8mb4;','username','password');

2)

../secrets.php:

    $mysqlusername = 'username';

    $mysqlpassword = 'password';



/file.php:

    require_once('../secrets.php');

    $newconn = new PDO('mysql:host=localhost;charset=utf8mb4;',$mysqlusername,$mysqlpassword);

3

../secrets.php:

    function pdoconn(i) {

        $mysqlusername = ['username1','username2'];

        $mysqlpassword = ['password1','password2'];

        $conn = new PDO('mysql:host=localhost;charset=utf8mb4;',$mysqlusername[i],$mysqlpassword[i]);

        return $conn;

    }



/file.php:

    require_once('../secrets.php');

    $newconn = pdoconn(0);

Example 1 is out of the question - incorrect configuration on production servers could end up showing sensitive parameters to unintended parties.

Example 2 is better, but those variables are available throughout the application, and modifiable, which could result in errors.

Example 3 keeps things very organised and transferable.

It can be modified to use globals if ../secrets.php instead was:

../secrets.php:

$mysqlusername = 'username';

$mysqlpassword = 'password';

function pdoconn()  {

    $conn = new

PDO('mysql:host=localhost;charset=utf8mb4;',$GLOBALS['mysqlusername'],$GLOBALS['mysqlpassword']);

return $conn;

}

And I think that demonstrates why a global doesn't make sense most of the time in quite a succinct way.

Summary:

As for security breaches using global variables (and why I wrote these examples in PHP), there was quite a (at the time) controversial change in PHP 4.2.0 where register_globals was turned on to off. I can't find any articles now, as this change was made in 2002, but I do seem to remember it being responsible for a few breaches at the time. Copying directly from the manual, there is a very clear example of vulnerable code:

<?php

// define $authorized = true only if user is authenticated

if (authenticated_user()) {

    $authorized = true;

}



// Because we didn't first initialize $authorized as false, this might be

// defined through register_globals, like from GET auth.php?authorized=1

// So, anyone can be seen as authenticated!

if ($authorized) {

    include "/highly/sensitive/data.php";

}

?>