note 35455 deleted from features.remote-files by vincent

Note Submitter: hk_heaven@hotmail.com (Savut) ---- Be careful when you use something like index.php?showpage=news.php and include() that $showpage file. If a malicious user would call your script as index.php?showpage=http://some.server/script.php it would include that script and run it in *your* script's scope. That means it can read all files and variables your webserver has access to! This is not true as http://some.server/script.php will only be executed by the server http://some.server and output that in the HTML form to the first server with index.php.