Re: Using 'header' as redirect
| From: | Philip Thompson | Date: | Tue, 30 May 2006 16:29:05 +0000 |
| Subject: | Re: Using 'header' as redirect | ||
| References: | 1 2 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-237094@lists.php.net to get a copy of this message | ||
Yes, I do tests to make sure that the file actually exists and what not. I have just simplified my code for this example....
~PT
On May 30, 2006, at 11:27 AM, Martin Alterisio wrote:
2006/5/30, Philip Thompson <prthomp@uark.edu>: <? if ($subPage = $_GET['page']) include ("$subPage"); ?> Are you checking what the user is sending inside $_GET['page']? If not, your system is vulnerable to a remote file injection.