how is this line a security risk?
| From: | michael | Date: | Tue, 23 Sep 2008 16:58:07 +0000 |
| Subject: | how is this line a security risk? | ||
| References: | 1 2 3 4 5 | Groups: | php.db |
| Request: | Send a blank email to php-db+get-45445@lists.php.net to get a copy of this message | ||
I get an error stating that this line in my code is a security risk when I code it.
require_once($PLUGINS_DIRECTORY."forum/forum.php");
here is what the explanation is:
include() or analogous is used with variable argument this can be dangerous since variables are in many cases controlled by remote users.
the recommended soloution is to write it this way
define('SCRIPT_PATH',"/htdocs");
include ('sSCRIPT_PATH."/Foo.inc");
my question is why is the other way safer? im kinda confused..