note 23244 deleted from function.include by rasmus
| From: | rasmus@php.net | Date: | Mon, 12 Aug 2002 14:16:01 +0000 |
| Subject: | note 23244 deleted from function.include by rasmus | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-34861@lists.php.net to get a copy of this message | ||
An important include tip:
include() will (now?) follow relative paths, no matter where you put them, so be very careful with
it.
For example:
include('/blah/blah/$foo');
Is very, very bad, because if someone gets nasty and adds '?foo=../../../../../etc/passwd'
to the URL it will work. (tested on 4.2.1/apache)
If you need to do this, one idea is to do a !strsr($foo,'../') to make sure no one's
trying anything funny, or find another solution.
Not much of a threat if you are setup properly - just something to note.