note 66178 added to reserved.variables

(it should be obvious, but that mistake is a plauge!) * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Never ever use $_GET in paths to filenames (include, fopen, readfile). * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * It does not help if you prefix path with something like "sites/", attacker may add ".." to path. It does not help if you suffix path with ".html", attacker may add %00 (NUL byte) and cut off your suffix. Trying to filter known attack vectors (known to you...) isn't much help. Variables from outside are safe only after you filter everything except known safe values. <?php $safe = preg_replace('/[^a-z0-9_]/i','',$_GET['unsafe']); ?> ---- Server IP: 85.116.0.130 Probable Submitter: 84.92.248.233 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/reserved.variables.php Edit -- http://master.php.net/note/edit/66178 Del: integrated -- http://master.php.net/note/delete/66178/integrated Del: useless -- http://master.php.net/note/delete/66178/useless Del: bad code -- http://master.php.net/note/delete/66178/bad+code Del: spam -- http://master.php.net/note/delete/66178/spam Del: non-english -- http://master.php.net/note/delete/66178/non-english Del: in docs -- http://master.php.net/note/delete/66178/in+docs Del: other reasons-- http://master.php.net/note/delete/66178 Reject -- http://master.php.net/note/reject/66178 Search -- http://master.php.net/manage/user-notes.php