note 37350 rejected from function.get-defined-constants by pollita
| From: | pollita@php.net | Date: | Wed, 12 Nov 2003 06:03:03 +0000 |
| Subject: | note 37350 rejected from function.get-defined-constants by pollita | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-60284@lists.php.net to get a copy of this message | ||
Note Submitter: webmaster@emugenerations.com
----
Never define important passwords (for example: database passwords) as constants, specially if you
have hosted sites within your site.
Someone could include your php lib file and use this function to know the password or other
information.
Example:
<?php
include($_SERVER['DOCUMENT_ROOT'] . "/../global_settings.php"); // This file has
a constant which is a password
print_r(get_defined_constants()); // The password IS DISPLAYED!
?>
Could this be a php security bug?