note 19348 deleted from features.remote-files by vincent

Note Submitter: php!at!sturmgewehr.de ---- Be careful when you use something like index.php?showpage=news.php and include() that $showpage file. If a malicious user would call your script as index.php?showpage=http://some.server/script.php it would include that script and run it in *your* script's scope. That means it can read all files and variables your webserver has access to! Use file_exists() (which only works on local files) or check for 'tp:' in the filename prior to inclusion.