Re: Security Issue
| From: | richard gray | Date: | Mon, 07 Jun 2010 20:26:15 +0000 |
| Subject: | Re: Security Issue | ||
| References: | 1 2 3 4 5 6 7 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-305922@lists.php.net to get a copy of this message | ||
On 07/06/2010 20:00, Igor Escobar wrote:
PHP Injection is the technical name given to a security hole in PHP applications. When this gap there is a hacker can do with an external code that is interpreted as an inner code as if the code included was more a part of the script. // my code... // my code... include ('http://..../externalhackscript.txt'); //my code... //my code.. can you not switch off remote file includes in php.ini?This will stop include/require from a remote host.. i.e. /allow_url_include = Off in php.ini HTH Rich /