note 100553 added to function.include

Be very careful with including files based on user inputed data. For instance, consider this code sample: index.php: <?php $page = $_GET['page']; if (file_exists('pages/'.$page.'.php')) { include('pages/'.$page.'.php'); } ?> Then go to URL: index.php?page=/../../../../../../etc/passwd%00.html file_exists() will return true, your passwd file will be included and since it's not php code it will be output directly to the browser. Of course the same vulnerability exists if you are reading a file to display, as in a templating engine. You absolutely have to sanitize any input string that will be used to access the filesystem, you can't count on an absolute path or appended file extension to secure it. Better yet, know exactly what options you can accept and accept only those options. ---- Server IP: 192.41.42.26 Probable Submitter: 24.10.166.92 ---- Manual Page -- http://www.php.net/manual/en/function.include.php Edit -- https://master.php.net/note/edit/100553 Del: integrated -- https://master.php.net/note/delete/100553/integrated Del: useless -- https://master.php.net/note/delete/100553/useless Del: bad code -- https://master.php.net/note/delete/100553/bad+code Del: spam -- https://master.php.net/note/delete/100553/spam Del: non-english -- https://master.php.net/note/delete/100553/non-english Del: in docs -- https://master.php.net/note/delete/100553/in+docs Del: other reasons-- https://master.php.net/note/delete/100553 Reject -- https://master.php.net/note/reject/100553 Search -- https://master.php.net/manage/user-notes.php