note 66178 deleted from reserved.variables by nlopess

Note Submitter: ---- (it should be obvious, but that mistake is a plauge!) * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * Never ever use $_GET in paths to filenames (include, fopen, readfile). * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * It does not help if you prefix path with something like "sites/", attacker may add ".." to path. It does not help if you suffix path with ".html", attacker may add %00 (NUL byte) and cut off your suffix. Trying to filter known attack vectors (known to you...) isn't much help. Variables from outside are safe only after you filter everything except known safe values. <?php $safe = preg_replace('/[^a-z0-9_]/i','',$_GET['unsafe']); ?>