As much as we love working with PHP, Register Globals is something that should be filed under "Monumentally Bad Ideas".  And unfortunately, it's something that, at first glance, appears convenient.  If a user submits a form to a PHP script with Register Globals enabled, the script will create a variable for each form element.  However, keep in mind that this allows your end users to set any variable in your script that they like.  Here is a common mistake that we see:
In a situation like this, the author has first run some code to see if the user is logged in or not.  If so, the script will have defined the $logged_in variable.  When the above line of code fires, it will provide the user with some functions only availble to authenticated users.  Innocent enough, yes?  However, to "hack" this, all that a malicious user would need to do is form a URL like http://www.example.com/?logged_in=1.  To turn off Register Globals, add php_flag register_globals off to .htaccess or register_globals = Off to php.ini.  Many administrators ban use of Register Globals entirely, so by developing without it, your script will be more portable.  This is a good thing.