note 42749 deleted from function.include by tomsommer
| From: | tomsommer@php.net | Date: | Thu, 27 May 2004 22:11:56 +0000 |
| Subject: | note 42749 deleted from function.include by tomsommer | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-70218@lists.php.net to get a copy of this message | ||
Note Submitter:
----
I've found a better way to protect against say:
include($_REQUEST['page'] . '.php'); and then someone
index.php?page=http://www.badsite.com/bad.php or
../../../etc/passwd
without a [slow] regular expression
<?php
if (is_file("$nav.php") && (addslashes($nav) === $nav)) {
include("$nav.php");
} else {
echo "Hack attempt!";
}
?>