note 59015 deleted from function.include by aidan
| From: | aidan@php.net | Date: | Sat, 15 Apr 2006 16:29:30 +0000 |
| Subject: | note 59015 deleted from function.include by aidan | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-108149@lists.php.net to get a copy of this message | ||
Note Submitter: Ting-Zien LEE
----
Take note the following works in a web cgi environment, which may be a big security issue:
a.php:
<? include("b.php"); ?>
b.php:
<?
$var = "<? echo('Hello World'); ?>";
echo($var);
?>
output:
Hello World
Mine's installed with suPHP and PHP 5.0.4.
Do not use include if your file to-be-included prints data from a publicly writable database (e.g.
forum, blog.) It may cause potential cross-site-scripting issues.