Re: Security

>I'd like to know if there is any vulnerability with PHP 4.0.4 pl1 running on >IIS servers. None that I'm aware of that are due to php, unless you write silly scripts which allow access to things they shouldn't. There are probably uncountable NT vulnerabilities though. One which recently frightened me was that if you append +.htr to a requested URL (eg www.mydomain.com/myphpfile.php - or indeed myaspfile.asp) on a standard setup you get the script source complete with any passwords you were unwise enough to put in there. Easily fixed by removing the .htr script mapping in the internet service manager, but frightening to find out you've been running your servers for several years whilst unaware of the problem. Cheer -- Phil Driscoll Dial Solutions +44 (0)113 294 5112 http://www.dialsolutions.com http://www.dtonline.org