note 20460 deleted from features.remote-files by irchtml
| From: | irchtml@php.net | Date: | Sat, 28 Feb 2004 07:56:23 +0000 |
| Subject: | note 20460 deleted from features.remote-files by irchtml | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-65923@lists.php.net to get a copy of this message | ||
Note Submitter: christer@frostmo.com
----
The easiest solution to this security risk is, in my oppinion, to add a host string in front of the
url specified in the url adress.
example:
<html>
<head><title>php.net</title></head>
<body>
<?php
include("http://www.php.net/".$HTTP_GET_VARS["url"]);
?>
</body>
</html>
yup =) It's impossible to include() an page from another server.
Regards,
Christer Frostmo
Norway
www.frostmo.com