Re: securing include()

Alexei -- [Now this would have been a perfect first post to see if you're subscribed!] ..and then Alexei Matveev said... % % Hi, Everybody, Hi! % % I am new in this list, hoping the % question matches the topic: % % How secure is this include($body) against % malicious body=/etc/passwd ??? % % $body = $GET['body']; From your description later, why do you need to pass the page what body it is supposed to incorporate? I'd think that the server side would be what knows that and that the browser wouldn't have to bother with it. Otherwise every URL http://yourserver.tld/url/path has to become http://yourserver.tld/url/path?header=H&body=B&footer=F even before you put on any other GET parameters to do any actual work. % % $body = preg_replace("/\.\./","XX",$body); % $body = preg_replace("|^/|","X",$body); % % include("./" . $body); Since you prepend a ./ here you don't need the second check above, so that's extraneous. What I generally do is a simple if (preg_match("/\.\./",$pic) or preg_match("/\.\./",$album)) # parent hunting { print "Please refrain from trying to access unauthorized files in this manner.<br>"; print "Have a nice day."; # bad surfer! no soup for you! print "</body></html>"; # close page exit ; # bail -- byebye! } figuring that if the visitor is poking where s/he shouldn't be then my contract to serve up the page has been waived. % % Are there more elegant ways to do the same? Probably :-) I'd start by moving out of the GET vars first, though. % % % Alexei HTH & HAND & wecome! :-D -- David T-G * There is too much animal courage in (play) davidtg@justpickone.org * society and not sufficient moral courage. (work) davidtgwork@justpickone.org -- Mary Baker Eddy, "Science and Health" http://justpickone.org/davidtg/ Shpx gur Pbzzhavpngvbaf Qrprapl Npg!