Re: Seeking recommendations for use of include()
| From: | Larry Garfield | Date: | Thu, 15 Jun 2006 07:01:41 +0000 |
| Subject: | Re: Seeking recommendations for use of include() | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-238038@lists.php.net to get a copy of this message | ||
On Wednesday 14 June 2006 21:48, Dave M G wrote:
> Jochem,
>
> > ::index.php
> >
> > <?php
> > include $_GET['page'];
> > ?>
>
> Wouldn't strip_tags() eliminate the <?php ?> tags that make this possible?
No, because that's not what the hole is. YOUR CODE is include $_GET['page'].
That's an easily exploitable hole, as explained.
--
Larry Garfield AIM: LOLG42
larry@garfieldtech.com ICQ: 6817012
"If nature has made any one thing less susceptible than all others of
exclusive property, it is the action of the thinking power called an idea,
which an individual may exclusively possess as long as he keeps it to
himself; but the moment it is divulged, it forces itself into the possession
of every one, and the receiver cannot dispossess himself of it." -- Thomas
Jefferson