Re: PHP Security

--- Richard Lynch <ceo@l-i-e.com> wrote: > There are times when one needs to parse a file that ends in .jpg > (or .jpeg) as PHP. I can't think of any, unless it's prove that you can do it. :-) > Specifically, broken browsers (various versions of IE) that ignore > Content-type: headers and use the URL to determine the MIME > type will not correctly display a URL such as: > > http://l-i-e.com/gd_example.php IE still ignores Content-Type in most cases (way to go, Microsoft), but this problem doesn't exist in recent versions, to my knowledge. > Said browser will, however, correctly handle: > http://l-i-e.com/gd_example.jpg > > Note that both images are dynamic and, in fact, the two source > files are Linux symbolic (hard) links, as is this PHP source code: > http://l-i-e.com/gd_example.phps There are better ways to do this than parsing .jpg files as PHP. One obvious one is: http://example.org/image.php/foo.jpg Another one that I've seen referenced frequently (especially back when this was a larger and more common problem) is this: http://example.org/image.php?iesucks=foo.jpg Chris ===== Chris Shiflett - http://shiflett.org/ PHP Security - O'Reilly HTTP Developer's Handbook - Sams Coming Soon http://httphandbook.org/