note 85037 deleted from language.oop5.patterns by danbrown
| From: | danbrown@php.net | Date: | Sun, 23 Jan 2011 16:37:24 +0000 |
| Subject: | note 85037 deleted from language.oop5.patterns by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-176098@lists.php.net to get a copy of this message | ||
Note Submitter: Anonymous
----
Apologies to tedmasterweb, since I was incorrect in my note just prior. His sanitizing method would
work, since it is based on known values from a switch statement. I had read it too quickly as the
more common method of simply appending ".php" to variable values used in include
directives in order to ensure that included files are PHP files, like so in a common __autoload
variety often seen in the wild:
<?php
function __autoload($class) {
require_once("path/to/classes/$class.php");
}
?>
This was the sort of unsafe usage of the include directives I was commenting on.