note 23938 added to function.copy
| From: | blue at designweavers dot c | Date: | Thu, 01 Aug 2002 20:37:18 +0000 |
| Subject: | note 23938 added to function.copy | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-34105@lists.php.net to get a copy of this message | ||
sorry, i messed the last post. Björn Nafe is wrong, anyone should know that allowing user input
into system commands 'n that is insecure.... observe:
copy $from $to
could be exploited to become
copy $from $to|rm /etc/passwd // or some other important system file....
Notice the pipe character which enables you to execute more than one command on the same line
--
http://www.php.net/manual/en/function.copy.php
http://master.php.net/manage/user-notes.php?action=edit+23938
http://master.php.net/manage/user-notes.php?action=delete+23938
http://master.php.net/manage/user-notes.php?action=reject+23938