note 73912 deleted from reserved.variables by nlopess

Note Submitter: Hellkeepa ---- HELLo! Even though "New York PHP" [1] already posted the warning, in 2005, I feel it's prudent to repeat it: Too many people doesn't seem to know about it. PHP_SELF is suspect to XSS attacks, if not cleaned! This is not a bug, but a feature. However, here's my fix to the issue: <?php // Security measure, to avoid XSS exploit. if (!empty ($_SERVER['PATH_INFO']) && strrpos ($_SERVER['PHP_SELF'], $_SERVER['PATH_INFO'])) { $_SERVER['PHP_SELF'] = substr ($_SERVER['PHP_SELF'], 0, -(strlen ($_SERVER['PATH_INFO']))); } ?> Just stick that at the top of the page, and you're secured. ;) For a discussion about this, please read here (norwegian site): http://norskwebforum.no/viewtopic.php?t=31699 [1] http://no.php.net/manual/en/reserved.variables.php#55068 Happy codin'!