Re: Re: Remote File Variable Injection Safety?

Shawn McKenzie wrote:

Daniel Kolbo wrote:

Hello, suppose there is a file at http://otherhost.com/remote.php that looks like this: <?php if (!isset($safe_flag)) { die("hacking attempt"); } echo "You are in"; ?> Suppose i executed the following php file at http://myhost.com/local.php <?php require_once("http://otherhost.com/remote.php"); ?> Is there any way to get local.php to display "You are in", by only modifying local.php? That is, is there a way to set $safe_flag on the remote host as one requests a file from the remote host from within local.php? I have genuine, academic, non-belligerent intentions when asking this question. Thanks, dK

local.php <?php $safe_flag = 1; require_once("http://otherhost.com/remote.php"); ?> The proposed method does not work, as the script returned from remote.php is "hacking attempt", because $safe_flag is in the scope of myhost.com and not otherhost.com.

dK