include

hi, i think there is a problem with the include function, but am not sure if anyone noticed it before or not so i didn't report to the bug but try this code 1) assume user1 is running a forum 2) user2 wants to grab his password and hosting on the same server as user1 user2 can simply run this code and he will grab all var on user1 site PHP CODE --------------------------- include('/home/user1/public_html/forum/admin/config.php'); echo "Variable list for User1: <b>"; $arr = get_defined_vars(); while (list ($key, $val) = each ($arr)) { echo "Varaiable Name: <b> $key => </b>Value: $val</b><br>\n"; } ----------------------------- i tried everything out there .htaccess php_value open_basedir "/" <File > Deny ALL </File> still i can grab the user1 information, you can easily grab the Real Path for userone if you are on the same server and knows its structure, as well as xploiting any weak coding on his site how is this solved? Thanks