Re: Newbie: Safe function call to a .inc file outside the web folder

From: Date: Fri, 26 Aug 2005 10:55:28 +0000
Subject: Re: Newbie: Safe function call to a .inc file outside the web folder
References: 1 2  Groups: php.general 
Request: Send a blank email to php-general+get-221421@lists.php.net to get a copy of this message
Chris Shiflett wrote:
Because $_SERVER['SERVER_NAME'] can be manipulated by the user in some cases, you must consider $temp tainted at this point.
I was under the the impression that the non-'HTTP_*' keys in the $_SERVER array came from the server itself. Obvoiusly I'm wrong, but I'm curoius how 'SERVER_NAME' could be manipulated by the client. Is there anything in the $_SERVER array that *can* be considered safe?

« previous php.general (#221421) next »