Re: Remote File Variable Injection Safety?
| From: | Daniel Kolbo | Date: | Wed, 07 Jan 2009 18:45:31 +0000 |
| Subject: | Re: Remote File Variable Injection Safety? | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-285586@lists.php.net to get a copy of this message | ||
ceo@l-i-e.com wrote:
If register_globals is "on" (ewww!) at otherhost.com, then "?safe_flag" on the URL will get in. This is one of the reasons why register_globals should be OFF. NOTE: The code you gave does not describe the circumstances whereby $safe_flag is "set". There could be all manner of other issues around that code that we cannot address without seeing more. There is no other code. This is an example I created to help me understand finer points of PHP.thanks, dK