note 69868 deleted from ref.zip by danbrown
| From: | danbrown@php.net | Date: | Sun, 25 Oct 2009 13:10:58 +0000 |
| Subject: | note 69868 deleted from ref.zip by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-162057@lists.php.net to get a copy of this message | ||
Note Submitter:
----
Previous poster's code is not using escape_shell_arg(), so it can be a huge security hole if
attacker could manipulate filename/dir. I suggest replacing str_replace() with sprintf() and
escape_shell_arg().