note 23938 deleted from function.copy by erica
| From: | erica@php.net | Date: | Fri, 06 Sep 2002 18:51:32 +0000 |
| Subject: | note 23938 deleted from function.copy by erica | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-36260@lists.php.net to get a copy of this message | ||
sorry, i messed the last post. Björn Nafe is wrong, anyone should know that allowing user input
into system commands 'n that is insecure.... observe:
copy $from $to
could be exploited to become
copy $from $to|rm /etc/passwd // or some other important system file....
Notice the pipe character which enables you to execute more than one command on the same line