note 9458 added to Filesystem Security
| From: | drdjr at _SendNoSpam_excite dot com | Date: | Sat, 04 Nov 2000 00:43:01 +0000 |
| Subject: | note 9458 added to Filesystem Security | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-7375@lists.php.net to get a copy of this message | ||
In example4-3, if one hacks $HTTP_REMOTE_USER to be '../etc/passwd'
then you will unlink '/home/../etc/passwd'
The last example is the safest... probably good to create a function called safe() and check for all
the nasties there when you need to make sure a variable is... uhm... safe!
http://www.php.net/manual/security.filesystem.php