note 35637 rejected from function.include by betz
| From: | betz@php.net | Date: | Tue, 09 Sep 2003 13:42:03 +0000 |
| Subject: | note 35637 rejected from function.include by betz | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-55886@lists.php.net to get a copy of this message | ||
Note Submitter: ash@walktalk.net
----
I think it's highly insecure that 'include' and 'require' support http:// url's by default. Why would you want to execute arbitrary code from
another web page? I have seen many sites where they are exploitable because they do
require $page. ".php";
Although this is bad programming, it's still insecure to allow http url's by default.
Also, I'd strongly suggest never using http includes unless you control the DNS for the domain
of the site you are connecting to. Otherwide the hostname could be changed over to a different
page.