note 13962 deleted from function.parse-str by jimw
| From: | jimw@php.net | Date: | Sat, 08 Dec 2001 21:17:37 +0000 |
| Subject: | note 13962 deleted from function.parse-str by jimw | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-22210@lists.php.net to get a copy of this message | ||
parse_str doesn't escape input securely - you have to do it yourself.
consider the following:
http://domain/postmsgs.php?forum_posting=$db_pass
parse_str will substitute $db_pass with it's value, which will post the password to the forum
in this context.