RE: [PHP] Fwd: PhpSmsSend remote execute commands bug
| From: | bvr | Date: | Wed, 30 Jan 2002 01:41:21 +0000 |
| Subject: | RE: [PHP] Fwd: PhpSmsSend remote execute commands bug | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-82636@lists.php.net to get a copy of this message | ||
I agree, but it may be usefull to tell those newbies that when you
execute a command from PHP that will get some parameters from an external
source (like a form or a get variable) ALWAYS use the
escapeshellcmd()
function to prevent users from executing arbitrary commands.
bvr.
>There's such a large possibility of crappily-written code out
>there, I don't know if its worth the traffic on this list
>given that it's usually newbies.