note 13962 added to function.parse-str.php
| From: | jw at turtle-entertainment dot de | Date: | Wed, 11 Jul 2001 17:50:01 +0000 |
| Subject: | note 13962 added to function.parse-str.php | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-15243@lists.php.net to get a copy of this message | ||
parse_str doesn't escape input securely - you have to do it yourself.
consider the following:
http://domain/postmsgs.php?forum_posting=$db_pass
parse_str will substitute $db_pass with it's value, which will post the password to the forum
in this context.
http://www.php.net/manual/en/function.parse-str.php