note 9458 modified in Filesystem Security by ronabop
| From: | ronabop@php.net | Date: | Sun, 05 Nov 2000 04:23:00 +0000 |
| Subject: | note 9458 modified in Filesystem Security by ronabop | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-7390@lists.php.net to get a copy of this message | ||
In example4-3, if one hacks $HTTP_REMOTE_USER to be '../etc/passwd;'
then you will unlink '/home/../etc/passwd'
The last example is the safest... probably good to create a function called safe_delete_check() and
check for all the nasties there when you need to make sure a variable is... uhm... safe!
http://www.php.net/manual/filesystem-security.php