note 27860 added to security.variables

To prevent the above noted abuse, you can always assure that register_globals is off (or if it isn't, exit). For example: if(ini_get('register_globals')) { print '<b>Fatal:</b> This script requires that register_globals in php.ini is disabled.'; exit; } // unlink files here Hugo. ps: in general: try to avoid removing files or exec'ing system commands in web-accessible scripts -- http://www.php.net/manual/en/security.variables.php http://master.php.net/manage/user-notes.php?action=edit+27860 http://master.php.net/manage/user-notes.php?action=delete+27860 http://master.php.net/manage/user-notes.php?action=reject+27860