¶GT\ProtectedGlobal\Protection

Protection is the orchestration class. In normal usage we create one instance, call removeGlobals(), then pass the result to overrideInternals().

¶removeGlobals(array $globalsToDeregister, array $whiteList = []): array

Takes an associative array of superglobal data and returns a new array containing only the whitelisted offsets.

Example:

$allowed = $protection->removeGlobals(
	[
		"_GET" => $_GET,
		"_POST" => $_POST,
	],
	[
		"_POST" => ["token"],
	]
);

Important points:

• The array keys should match the superglobal names we want to protect, such as "_GET" and "_POST".
• The whitelist keys use the same naming.
• Missing whitelisted offsets are created with the value null.
• The return value is intended to be passed directly to overrideInternals().

¶overrideInternals(array $whitelistedGlobals): void

Replaces the internal PHP superglobals with ProtectedGlobal objects.

The class protects the following superglobals:

• $_ENV
• $_SERVER
• $_GET
• $_POST
• $_FILES
• $_COOKIE
• $_SESSION

Each protected global receives the corresponding whitelisted data from the array passed in.

¶GT\ProtectedGlobal\ProtectedGlobal

This class implements ArrayAccess and acts as the protective wrapper around each superglobal.

¶__construct(array $whiteListData = [])

Creates a new wrapper around the provided whitelist data.

¶Array access methods

The following operations are supported through array syntax:

• isset($global["key"])
• $global["key"]
• $global["key"] = $value
• unset($global["key"])

For non-whitelisted offsets, each of those operations throws ProtectedGlobalException.

¶WARNING_MESSAGE

The class exposes a WARNING_MESSAGE constant used in string conversion and debug output:

Global variables are protected - see https://php.gt/globals

¶GT\ProtectedGlobal\ProtectedGlobalException

This is the dedicated exception thrown when blocked global access is attempted.

It extends PHP’s base Exception class and does not add extra methods. Its purpose is semantic clarity: the exception tells us exactly why the access failed.