note 45647 deleted from features.remote-files by salathe

Note Submitter: heck at fas dot harvard dot edu ---- The previous post is part right, part wrong. It's part right because it's true that the php script will run on the remote server, if it's capable of interpreting php scripts. You can see this by creating this script on a remote machine: <?php echo system("hostname"); ?> Then include that in a php file on your local machine. When you view it in a browser, you'll see the hostname of the remote machine. However, that does not mean there are no security worries here. Just try replacing the previous script with this one: <?php echo "<?php system(\"hostname\"); ?>"; ?> I'm guessing you can figure out what that's gonna do. So yes, remote includes can be a major security problem.