RE: [PHP] Defining PHP varibles from URL
| From: | John Holmes | Date: | Sun, 05 May 2002 17:54:31 +0000 |
| Subject: | RE: [PHP] Defining PHP varibles from URL | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-96149@lists.php.net to get a copy of this message | ||
> <snip>
> file.php?file=inc.foobar.php
> -------------------------
> include("include/$file");
> </snip>
That doesn't fix anything...
file.php?file=../../../etc/passwd
Just a matter of a few tries to see how many directories you have to go
up...
---John Holmes...