note 19348 added to features.remote-files

Be careful when you use something like index.php?showpage=news.php and include() that $showpage file. If a malicious user would call your script as index.php?showpage=http://some.server/script.php it would include that script and run it in *your* script's scope. That means it can read all files and variables your webserver has access to! Use file_exists() (which only works on local files) or check for 'tp:' in the filename prior to inclusion. -- http://www.php.net/manual/en/features.remote-files.php http://master.php.net/manage/user-notes.php?action=edit+19348 http://master.php.net/manage/user-notes.php?action=delete+19348 http://master.php.net/manage/user-notes.php?action=reject+19348