Bug #13749: >?php instead of <?php displays password and user info

From: Date: Fri, 19 Oct 2001 12:50:19 +0000
Subject: Bug #13749: >?php instead of <?php displays password and user info
Groups: php.dev 
Request: Send a blank email to php-dev+get-68367@lists.php.net to get a copy of this message 
From:             malcolm@prebon.co.uk
Operating system: Linux
PHP version:      4.0.6
PHP Bug Type:     MySQL related
Bug description:  >?php instead of <?php displays password and user info

If you have a script that talks to a MySQL db and includes an inc in
another directory with the login part of the script and you mistype the
start as >?php instead of <?php then php returns the text of the inc file (
which contains the ip address, username and password of the mysql server
)
This is what the script returned ( with real info which I have removed )

<?xml version="1.0" encoding="ISO-8859-1" standalone="no"?>
>?php
#
#dbconnect.inc
#
function &dbconnect()
{
	$link=@mysql_connect ("172.nnn.nnn.nn","xxxxx","yyyyyy");
	if ($link && mysql_select_db ("pwtdb"))
	{
		$dbok="True";
		return $dbok;
	}
	else
	{
		$dbok="False";
		return $dbok;
	}
}
?><br>
<b>Fatal error</b>:  Call to undefined function:  dbconnect() in
<b>/usr/local/apache/htdocs/pwtvalidate.php</b> on line <b>37</b><br>



-- 
Edit bug report at: http://bugs.php.net/?id=13749&edit=1

Thread (5 messages)

« previous php.dev (#68367) next »