note 35455 added to features.remote-files

Be careful when you use something like index.php?showpage=news.php and include() that $showpage file. If a malicious user would call your script as index.php?showpage=http://some.server/script.php it would include that script and run it in *your* script's scope. That means it can read all files and variables your webserver has access to! This is not true as http://some.server/script.php will only be executed by the server http://some.server and output that in the HTML form to the first server with index.php. ---- Manual Page -- http://www.php.net/manual/en/features.remote-files.php Edit Note -- http://master.php.net/manage/user-notes.php?action=edit+35455 Delete Note -- http://master.php.net/manage/user-notes.php?action=delete+35455&report=yes Reject Note -- http://master.php.net/manage/user-notes.php?action=reject+35455&report=yes