Re: securing include()

On Wednesday 16 April 2003 16:17, Alexei Matveev wrote: > Hi, Everybody, > > I am new in this list, hoping the > question matches the topic: > > How secure is this include($body) against > malicious body=/etc/passwd ??? > > $body = $GET['body']; > > $body = preg_replace("/\.\./","XX",$body); > $body = preg_replace("|^/|","X",$body); > > include("./" . $body); > > Are there more elegant ways to do the same? Use basename() to strip off any leading paths leaving just the filename. Then prepend your own base directory. -- Jason Wong -> Gremlins Associates -> www.gremlins.biz Open Source Software Systems Integrators * Web Design & Hosting * Internet & Intranet Applications Development * ------------------------------------------ Search the list archives before you post http://marc.theaimsgroup.com/?l=php-general ------------------------------------------ /* Time goes, you say? Ah no! Time stays, *we* go. -- Austin Dobson */