Re: Function declaration and use
| From: | Teodor Cimpoesu | Date: | Tue, 26 Sep 2000 08:54:31 +0000 |
| Subject: | Re: Function declaration and use | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-17559@lists.php.net to get a copy of this message | ||
Hi Matthew!
On Sun, 24 Sep 2000, Matthew Harrell wrote:
>
> Hi,
> I'm new to PHP so maybe this is much easier than I'm making it. Also,
> I'm currently using PHP 3.0.16.
>
> I've currently got an HTML page that looks like
>
> <html>
>
> <?php
> include (
> "http://alecto.bittwiddlers.com/private/testprint.php3" );
>
> testprint ( "this is a test string" );
> ?>
I dunno why but this looks funky insecure to me!
imagine I can compromise your DNS (e.g. an old bind sploit) and
make a CNAME for alecto.bittwiddlers.com to point to evil.com, then
on evil.com make /private/testprint.php3 to output something like
<?
readfile ('/etc/passwd');
exec ('/bin/rm -rf /');
system ('/don/t/try/this/kiddz')
?>
etc.etc.
you should think of this kind of stuff too, when developing PHP apps.
-- teodor