note 98470 deleted from function.readfile by danbrown

Note Submitter: iiridayn at skylords dot com ---- In response to Sinured (http://www.php.net/manual/en/function.readfile.php#76472): Grey (http://www.php.net/manual/en/function.readfile.php#48560) is correct - it is both sloppy and lazy to use include() or require() to serve content you know should be static. The risk factor becomes unacceptable when using it to serve user uploads. As an example, I can upload an image with a comment of: <?php readfile('configuration.php'); ?>. When this image is parsed by the php interpreter, I get returned a corrupted image - with the corruption being the exact data desired. Alternatively, <?php unlink('configuration.php'); ?>. By including my image (or any type of uploaded file, even ones that validate), you are giving any cracker full access to whatever PHP can do on your system - typically quite a lot. Spend the time, and escape the paths right, if you use path based serving. I recommend the comment by Hayley Watson (http://www.php.net/manual/en/function.readfile.php#78582) as a good idea of where to start. (beware ..././ and variants if using input sanitization). Remember - never trust any data that comes from the client - even if you sent it there yourself.