securing include()
| From: | Alexei Matveev | Date: | Wed, 16 Apr 2003 08:17:19 +0000 |
| Subject: | securing include() | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-144081@lists.php.net to get a copy of this message | ||
Hi, Everybody,
I am new in this list, hoping the
question matches the topic:
How secure is this include($body) against
malicious body=/etc/passwd ???
$body = $GET['body'];
$body = preg_replace("/\.\./","XX",$body);
$body = preg_replace("|^/|","X",$body);
include("./" . $body);
Are there more elegant ways to do the same?
Alexei