Re: Remote File Variable Injection Safety?
| From: | ceo at l-i-e dot com | Date: | Wed, 07 Jan 2009 18:42:06 +0000 |
| Subject: | Re: Remote File Variable Injection Safety? | ||
| Groups: | php.general | ||
| Request: | Send a blank email to php-general+get-285585@lists.php.net to get a copy of this message | ||
If register_globals is "on" (ewww!) at otherhost.com, then "?safe_flag" on the
URL will get in.
This is one of the reasons why register_globals should be OFF.
NOTE:
The code you gave does not describe the circumstances whereby $safe_flag is "set". There
could be all manner of other issues around that code that we cannot address without seeing more.