note 15614 deleted from function.include by irc-html
| From: | irc-html@php.net | Date: | Sat, 19 Jan 2002 19:33:08 +0000 |
| Subject: | note 15614 deleted from function.include by irc-html | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-25252@lists.php.net to get a copy of this message | ||
Security Alert! When including files through variables like this:
[url]: somefile.php?p=231
$to_include = $p."html";
include($to_include);
always make sure you filter out any unwanted value of $p, since then someone can include files on a
remote server and through this file, he can gain access full access on your PC!