note 98470 added to function.readfile

In response to Sinured (http://www.php.net/manual/en/function.readfile.php#76472): Grey (http://www.php.net/manual/en/function.readfile.php#48560) is correct - it is both sloppy and lazy to use include() or require() to serve content you know should be static. The risk factor becomes unacceptable when using it to serve user uploads. As an example, I can upload an image with a comment of: <?php readfile('configuration.php'); ?>. When this image is parsed by the php interpreter, I get returned a corrupted image - with the corruption being the exact data desired. Alternatively, <?php unlink('configuration.php'); ?>. By including my image (or any type of uploaded file, even ones that validate), you are giving any cracker full access to whatever PHP can do on your system - typically quite a lot. Spend the time, and escape the paths right, if you use path based serving. I recommend the comment by Hayley Watson (http://www.php.net/manual/en/function.readfile.php#78582) as a good idea of where to start. (beware ..././ and variants if using input sanitization). Remember - never trust any data that comes from the client - even if you sent it there yourself. ---- Server IP: 192.41.42.26 Probable Submitter: 97.75.165.74 ---- Manual Page -- http://www.php.net/manual/en/function.readfile.php Edit -- https://master.php.net/note/edit/98470 Del: integrated -- https://master.php.net/note/delete/98470/integrated Del: useless -- https://master.php.net/note/delete/98470/useless Del: bad code -- https://master.php.net/note/delete/98470/bad+code Del: spam -- https://master.php.net/note/delete/98470/spam Del: non-english -- https://master.php.net/note/delete/98470/non-english Del: in docs -- https://master.php.net/note/delete/98470/in+docs Del: other reasons-- https://master.php.net/note/delete/98470 Reject -- https://master.php.net/note/reject/98470 Search -- https://master.php.net/manage/user-notes.php