note 85862 added to function.include

Just about any file type can be 'included' or 'required'. By sending appropriate headers, like in the below example, the client would normally see the output in their browser as an image or other intended mime type. You can also embed text in the output, like in the example below. But an image is still an image to the client's machine. The client must open the downloaded file as plain/text to see what you embedded. <?php header('Content-type: image/jpeg'); header('Content-Disposition: inline;'); include '/some_image.jpg'; echo 'This file was provided by example@user.com.'; ?> Which brings us to a major security issue. Scripts can be hidden within images or files using this method. For example, instead echoing "<?php phpinfo(); ?>", a foreach/unlink loop through the entire filesystem, or some other method of disabling security on your machine. 'Including' any file made this way will execute those scripts. NEVER 'include' anything that you found on the web or that users upload or can alter in any way. Instead, use something a little safer to display the found file, like "echo file_get_contents('/some_image.jpg');" ---- Server IP: 64.71.164.2 Probable Submitter: 24.107.184.98 ---- Manual Page -- http://www.php.net/manual/en/function.include.php Edit -- https://master.php.net/note/edit/85862 Del: integrated -- https://master.php.net/note/delete/85862/integrated Del: useless -- https://master.php.net/note/delete/85862/useless Del: bad code -- https://master.php.net/note/delete/85862/bad+code Del: spam -- https://master.php.net/note/delete/85862/spam Del: non-english -- https://master.php.net/note/delete/85862/non-english Del: in docs -- https://master.php.net/note/delete/85862/in+docs Del: other reasons-- https://master.php.net/note/delete/85862 Reject -- https://master.php.net/note/reject/85862 Search -- https://master.php.net/manage/user-notes.php