note 73629 deleted from function.readfile by philip
| From: | philip@php.net | Date: | Mon, 05 Mar 2007 06:38:19 +0000 |
| Subject: | note 73629 deleted from function.readfile by philip | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-124087@lists.php.net to get a copy of this message | ||
Note Submitter: Adam F
----
egingell at sisna dot com's comment is COMPLETELY wrong.
That still allows access to system files (just because they dont end in .php doesnt mean they arnt
worth protecting), and gives an attacker free reign at any file the webserver process can access.
Proper escaping through a php function is highly recommended if whitelisting files isnt an option.