Since you should initialize variables anyway, why disable %register_globals%? Disabling %register_globals% reduces the risk without reducing notification. Setting %error_reporting% to %E_ALL% increases notification without increasing risk. Use this.