Any security issues with preg_match and web form input ?
| From: | Richard A. DeVenezia | Date: | Tue, 09 Dec 2003 21:15:01 +0000 |
| Subject: | Any security issues with preg_match and web form input ? | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-172294@lists.php.net to get a copy of this message | ||
I accept a regex search term posted from a form, but I use $_REQUEST, so a
person could throw the search term on the url if they wanted to.
Am I open to any security breaches ?
$search_term = isset ($_REQUEST ['search']) ? $_REQUEST ['search'] :
'';
if ($search_term != "") {
...
$contents = join ("", file($file));
if (preg_match ("/$search_term/i", $contents)) {
}
...
}
Thanks,
--
Richard A. DeVenezia