note 78812 rejected from function.include by nlopess
| From: | nlopess@php.net | Date: | Mon, 29 Oct 2007 12:48:26 +0000 |
| Subject: | note 78812 rejected from function.include by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-131808@lists.php.net to get a copy of this message | ||
Note Submitter: myphp dot 20 dot blacksheep at spamgourmet dot com
----
Hello,
How can I persuade you to add another warning at a very prominent place (preferrably in the first
screen content)?
The text would be something like:
"Never use include() or require() with a non-sanitized variable.
In most cases adding a './' concatenated before the variable name will suffice"
You wouldn't imagine the number of webspaces that are hacked with remote file inclusion.
HTH,
Torge