I had to turn on register globals in php.ini, but aparently this is a possible security risk. Is there some way I can turn this option on per site and leave off serverwide?

It's a risk to the program that's being run if it hasn't been coded properly.

Basically turning it off helps protect programmers who don't know to protect their code.

If a PHP script is programmed well it shouldn't matter if register_globals is on OR off.

Most script today require register globals on, so you could let it on server side. You can add it in vhost.conf
php_admin_flag register_globals off