note 66357 added to function.include

at spam guard dot gmail com to php dot net at reinsveien dot com: if you know the domain the file should be coming from then you can parse the variable for the domain and make sure that it matches the domain you expect, example: <?php $path="/full/path/to/script/"; if (getdomain($path) == 'yourdomain'){ include($path.'somefile.php'); } ?> this should prevent remote execution of any malicious script ---- Server IP: 66.163.161.117 Probable Submitter: 63.147.193.131 (proxied: 1.0 AP-ISA) ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.include.php Edit -- http://master.php.net/note/edit/66357 Del: integrated -- http://master.php.net/note/delete/66357/integrated Del: useless -- http://master.php.net/note/delete/66357/useless Del: bad code -- http://master.php.net/note/delete/66357/bad+code Del: spam -- http://master.php.net/note/delete/66357/spam Del: non-english -- http://master.php.net/note/delete/66357/non-english Del: in docs -- http://master.php.net/note/delete/66357/in+docs Del: other reasons-- http://master.php.net/note/delete/66357 Reject -- http://master.php.net/note/reject/66357 Search -- http://master.php.net/manage/user-notes.php