I have searched through Stack Overflow, with the search bar and only got 4 posts which state these are bad things to turn on.
No full reasons as to why?
So i am posting this question to find out the following:
Why are these such a bad thing to do? What risks do they open your server up too?
Why are the superglobals in PHP still if they are such a draw back?
What could they be used for?
Superglobals aren't bad, and they're always turned on. Without them, you wouldn't have access to things like $_GET
or $_POST
.
I suspect you're talking about Register Globals, which are deprecated in PHP 5.3 and removed in PHP 5.4. They are unambiguously bad. They let anybody instantiate arbitrary global variables in your code. There is lots of information kicking around about why they're bad, up to and including their own page in the documentation.
register_globals
all by themselves aren't a problem.
It's the combination of:
Executing all code in the global scope
Never initializing variables
Having then random variables occur from outside input (register_globals).
Sadly, that's the common case and how they were utilized in the PHP3/PHP4 era. Which is why the overgeneralized meme "register_globals are bad" is actually correct.
You could write perfectly sane code with them enabled, but it's an unneccessary pitfall.