Re: Interesting article about PHP security exploit by GIF files

On Wed, 2007-06-20 at 15:12 -0400, Daniel Brown wrote: > On 6/20/07, tedd <tedd@sperling.com> wrote: > > At 12:53 PM -0400 6/20/07, Daniel Brown wrote: > > > > > > No, not the upload and execution, per se, but rather using images > > >to contain processable PHP code. > > > > > >-- > > >Daniel P. Brown > > > > > > Daniel: > > > > Wow! Now that's something I would like to see -- you do have a demo? > > > > As far as "legitimate reasons", how about image buttons that execute > > code without having to tied them to "href=" statements. Like a "grab > > this image for that function" sort of thing. I see lot's of > > possibilities. Except that as soon as the button is loaded by the browser you'll trigger that functionality. I don't think it'll do what you want Ted :) I'm going to be honest, I don't really see any good reason to legitimately put PHP code in an image that can be loaded by the browser. I can see using URL rewriting to rewrite a special image name to a PHP script, but not using an image explicitly. If you use an image explicitly then it means the PHP engine is loaded for every single image request (unless you've only opened it up to certain directories via .htaccess or whatnot). Cheers, Rob. -- .------------------------------------------------------------. | InterJinn Application Framework - http://www.interjinn.com | :------------------------------------------------------------: | An application and templating framework for PHP. Boasting | | a powerful, scalable system for accessing system services | | such as forms, properties, sessions, and caches. InterJinn | | also provides an extremely flexible architecture for | | creating re-usable components quickly and easily. | `------------------------------------------------------------'