RE: [PHP] Safety with PHP.
| From: | Rasmus Lerdorf | Date: | Tue, 03 Apr 2001 05:54:08 +0000 |
| Subject: | RE: [PHP] Safety with PHP. | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-46766@lists.php.net to get a copy of this message | ||
So you wrote a script that took a filename as an argument somehow and did
something with it? That's always going to be insecure unless you do a lot
of error checking on it.
-Rasmus
On Tue, 3 Apr 2001, Marthe Kristiansen wrote:
> Well, since I'm a newbie and also Norwegian it ain't that easy to explain
> very simple.
> What he did was that he entered a file that showed all the users of the
> server, as I said, and he told me this was kindof insecure.
> To prevent it he showed me a code that would help a bit.
>
> $filename=str_replace("..","",$filename);
> $filename=str_replace("/","",$filename);
> $filename=str_replace("%20","",$filename);
>
> He used /, .. and %20 to reach this file on my server.
>
> /Marthe