Having Joomla's RG_EMULATION set to ON is a security risk. It should be turned off. RG_EMULATION is provided as a stop-gap measure in the event that a Joomla component you require does not function properly without register_globals on. Best practices dictates that a component shouldn't require register_globals on, but if it was poorly coded it might rely on the automatic "variabilization" of parameters that register_globals offers. RG_EMULATION is somewhat more secure than pure register_globals, but still subject to possible exploits.