note 66416 added to function.preg-match

I seem to have made two critical mistakes in my previous entry, to correct the problem I'm re-pasting my entry (I hope an admin can delete the other entry?): I want to make an important notice to everyone using preg_match to validate a file used for inclusion. If you use preg_match like so (like I have in the past): <?php if (preg_match("/(.*)\.txt$/", $_GET['file'])) { include($_GET['file']); } ?> Be sure to know that you can get around that security by using a null string terminator, like so: page.php?file=/etc/passwd%00.txt Quick explanation: strings end in a null string terminator which is what seperates strings (%00 is hex for the null string terminator character). What this does is effectively rule out everything after %00 and validate this string (if I understand correctly by the way preg_match handles this) leading in the inclusion of the servers' /etc/passwd file. One way to go around it is by doing something like this: <?php if (preg_match("/^[a-zA-Z0-9\/\-\_]+\.txt$/", $_GET['file'])) { include($_GET['file']); } ?> Which will check if (from the start) it consists of alphanumberic characters and can possibly contain a slash (subdirectories), underscore and a dash (used by some in filenames) and ends at the end of the string in ".txt". ---- Server IP: 84.18.202.180 Probable Submitter: 24.132.90.49 ---- X-Spam-Status: No, hits=3.1 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER autolearn=no version=2.64 ---- Manual Page -- http://www.php.net/manual/en/function.preg-match.php Edit -- http://master.php.net/note/edit/66416 Del: integrated -- http://master.php.net/note/delete/66416/integrated Del: useless -- http://master.php.net/note/delete/66416/useless Del: bad code -- http://master.php.net/note/delete/66416/bad+code Del: spam -- http://master.php.net/note/delete/66416/spam Del: non-english -- http://master.php.net/note/delete/66416/non-english Del: in docs -- http://master.php.net/note/delete/66416/in+docs Del: other reasons-- http://master.php.net/note/delete/66416 Reject -- http://master.php.net/note/reject/66416 Search -- http://master.php.net/manage/user-notes.php