Re: PHP File Upload Security Hole - Still No Fix?

Ok.. so since *all* webbrowser will encode it as you say.. WHY should it be encoded then? Explain for us! =) The data that will be sent will anyway be the same! Just tell me why you make your page so much safer by writing &amp; in urls instead of a plain ampersand ( & ) character. ----- Original Message ----- From: Jon Ribbens <jon+php-dev@unequivocal.co.uk> To: php-dev <php-dev@lists.php.net> Cc: Johan Andersson <johan@andersson.net> Sent: Wednesday, September 06, 2000 4:17 PM Subject: Re: [PHP-DEV] PHP File Upload Security Hole - Still No Fix? > Derick Rethans <d.rethans@jdimedia.nl> wrote: > > > is wrong. It should be: > > > > > > <a href="foo.php?a=1&amp;b=2"> > > > > This is bullshit. > > No, it's a little-known fact. > > > I never saw someone writing &amp;. > > I told you not a lot of people knew it. > > > I don't see why it is wrong, or why it can be dangerous to use &. > > If you don't believe me, simply try putting the following HTML page onto > a web server and try clicking on the links in a web browser. > > <html><head><title>Foo</title></head> > <body> > <a href="foo?a=1&b=1">a=1&amp;b=1</a><br> > <a href="foo?a=1&amp;b=1">a=1&amp;amp;b=1</a><br> > <a href="foo?a=1&pound=1">a=1&amp;pound=1</a><br> > <a href="foo?a=1&amp;pound=1">a=1&amp;amp;pound=1</a><br> > </body></html> > > If you don't understand why this is the case, try thinking about it for > a bit. It is not the server which decodes this - the server will indeed > receive 'a=1&b=1'. It is the *browser* which decodes the entity, just as > with any other entity it finds in an HTML document. > > -- > PHP Development Mailing List <http://www.php.net/> > To unsubscribe, e-mail: php-dev-unsubscribe@lists.php.net > For additional commands, e-mail: php-dev-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net > >