Researcher: Dr.RoVeR Ref: http://www.milw0rm.com/exploits/3705 index.php calls functions.php, which itself contains: if (isset($_GET[site])) { $site=$_GET[site]; } else { $site= "home"; } Later in index.php, we see the 'include $site.".php"' referenced by the researcher. So, in this case, it looks like we don't need register_globals. - Steve