note 27860 deleted from security.variables by nlopess
| From: | nlopess@php.net | Date: | Sat, 10 Jan 2004 15:59:02 +0000 |
| Subject: | note 27860 deleted from security.variables by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-63277@lists.php.net to get a copy of this message | ||
Note Submitter: hugo@GO_SPAMASSASSIN.gewis.nl
----
To prevent the above noted abuse, you can always assure that register_globals is off (or if it
isn't, exit).
For example:
if(ini_get('register_globals')) {
print '<b>Fatal:</b> This script requires that register_globals in php.ini is
disabled.';
exit;
}
// unlink files here
Hugo.
ps: in general: try to avoid removing files or exec'ing system commands in web-accessible
scripts