RE: [PHP] Restrict uploaded scripts
| From: | Jim Moseby | Date: | Fri, 09 Jun 2006 14:47:37 +0000 |
| Subject: | RE: [PHP] Restrict uploaded scripts | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-237702@lists.php.net to get a copy of this message | ||
>
> Wouldn't it even be posible, if the script couldn't be run
> directly, but
> had to be run through require or something like that?
>
Require just includes the code inline. It still runs on the webserver as
the server user as if it were one big script. I think you would have to
sanitize the uploaded code before allowing it to run. Writing the
sanitation algorithm to perform such a task would be a nightmare.
JM