note 73912 added to reserved.variables

HELLo! Even though "New York PHP" [1] already posted the warning, in 2005, I feel it's prudent to repeat it: Too many people doesn't seem to know about it. PHP_SELF is suspect to XSS attacks, if not cleaned! This is not a bug, but a feature. However, here's my fix to the issue: <?php // Security measure, to avoid XSS exploit. if (!empty ($_SERVER['PATH_INFO']) && strrpos ($_SERVER['PHP_SELF'], $_SERVER['PATH_INFO'])) { $_SERVER['PHP_SELF'] = substr ($_SERVER['PHP_SELF'], 0, -(strlen ($_SERVER['PATH_INFO']))); } ?> Just stick that at the top of the page, and you're secured. ;) For a discussion about this, please read here (norwegian site): http://norskwebforum.no/viewtopic.php?t=31699 [1] http://no.php.net/manual/en/reserved.variables.php#55068 Happy codin'! ---- Server IP: 83.137.200.2 Probable Submitter: 80.213.106.161 ---- Manual Page -- http://www.php.net/manual/en/reserved.variables.php Edit -- https://master.php.net/note/edit/73912 Del: integrated -- https://master.php.net/note/delete/73912/integrated Del: useless -- https://master.php.net/note/delete/73912/useless Del: bad code -- https://master.php.net/note/delete/73912/bad+code Del: spam -- https://master.php.net/note/delete/73912/spam Del: non-english -- https://master.php.net/note/delete/73912/non-english Del: in docs -- https://master.php.net/note/delete/73912/in+docs Del: other reasons-- https://master.php.net/note/delete/73912 Reject -- https://master.php.net/note/reject/73912 Search -- https://master.php.net/manage/user-notes.php