note 102519 added to function.curl-setopt

When using CURLOPT_POSTFIELDS with an array as parameter, you have to pay high attention to user input. Unvalidated user input will lead to serious security issues. <?php /** * test.php: */ $ch = curl_init('http://example.com'); curl_setopt($ch, CURLOPT_POST, 1); curl_setopt($ch, CURLOPT_POSTFIELDS, array( 'foo' => $_GET['bar'] )); curl_exec($ch); ?> Requesting "test.php?bar=@/home/user/test.png" will send "test.png" to example.com. Make sure you remove the leading "@" from user input. ---- Server IP: 69.147.83.197 Probable Submitter: 91.64.81.212 ---- Manual Page -- http://www.php.net/manual/en/function.curl-setopt.php Edit -- https://master.php.net/note/edit/102519 Del: integrated -- https://master.php.net/note/delete/102519/integrated Del: useless -- https://master.php.net/note/delete/102519/useless Del: bad code -- https://master.php.net/note/delete/102519/bad+code Del: spam -- https://master.php.net/note/delete/102519/spam Del: non-english -- https://master.php.net/note/delete/102519/non-english Del: in docs -- https://master.php.net/note/delete/102519/in+docs Del: other reasons-- https://master.php.net/note/delete/102519 Reject -- https://master.php.net/note/reject/102519 Search -- https://master.php.net/manage/user-notes.php