note 14866 deleted from security.cgi-bin by tomsommer
| From: | tomsommer@php.net | Date: | Sun, 04 Jul 2004 16:56:44 +0000 |
| Subject: | note 14866 deleted from security.cgi-bin by tomsommer | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-72539@lists.php.net to get a copy of this message | ||
Note Submitter:
----
About the "Escape Shell" Vulnerability & the acceptable chars...
$characters = "abcdefghijklmnopqrstuvwxyz0123456789.";
...is not right...these are supposed to be acceptable chars for a domain? right? well domains can
have a - char in it (dash)...so should be...
$characters = "abcdefghijklmnopqrstuvwxyz0123456789.-";
...or atleast something with - in it