note 15614 added to function.include
| From: | raphaelp at nr1webresource dot com | Date: | Sun, 23 Sep 2001 10:40:16 +0000 |
| Subject: | note 15614 added to function.include | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-18210@lists.php.net to get a copy of this message | ||
Security Alert! When including files through variables like this:
[url]: somefile.php?p=231
$to_include = $p."html";
include($to_include);
always make sure you filter out any unwanted value of $p, since then someone can include files on a
remote server and through this file, he can gain access full access on your PC!
--
http://www.php.net/manual/en/function.include.php
http://master.php.net/manage/user-notes.php?action=edit+15614
http://master.php.net/manage/user-notes.php?action=delete+15614
http://master.php.net/manage/user-notes.php?action=reject+15614