note 85198 added to function.checkdnsrr

These Windows checkdnsrr() replacement functions in the comments are handy, but none of them appear to be escaping the input data before they call the nslookup.exe program via the shell. Thus, if the hostname being passed to the replacement functions is something unexpected like, say, "microsoft.com; cd \; deltree *.*", the exec() function will happily execute all of those malicious user specified commands. The solution would be to properly validate input data, only allowing characters that could be found in a hostname according to the proper RFCs. ---- Server IP: 69.147.83.197 Probable Submitter: 75.182.71.36 ---- Manual Page -- http://www.php.net/manual/en/function.checkdnsrr.php Edit -- https://master.php.net/note/edit/85198 Del: integrated -- https://master.php.net/note/delete/85198/integrated Del: useless -- https://master.php.net/note/delete/85198/useless Del: bad code -- https://master.php.net/note/delete/85198/bad+code Del: spam -- https://master.php.net/note/delete/85198/spam Del: non-english -- https://master.php.net/note/delete/85198/non-english Del: in docs -- https://master.php.net/note/delete/85198/in+docs Del: other reasons-- https://master.php.net/note/delete/85198 Reject -- https://master.php.net/note/reject/85198 Search -- https://master.php.net/manage/user-notes.php