Re: download script
| From: | John W. Holmes | Date: | Tue, 10 Aug 2004 19:43:51 +0000 |
| Subject: | Re: download script | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-193376@lists.php.net to get a copy of this message | ||
"Aaron Todd" aaloki88@hotmail.com> wrote in message
> > $file = "/home/dlr/test/".$_GET['file']."";
> Why would this be a security hole if I do not filter the file
> name before I use it?
http://www.yourdomain.com/yourfile.php?file=../../path/to/any/file/on/machine
---John Holmes...