note 51275 deleted from function.odbc-execute by nlopess

From: Date: Fri, 25 Mar 2005 14:10:05 +0000
Subject: note 51275 deleted from function.odbc-execute by nlopess
References: 1  Groups: php.notes 
Request: Send a blank email to php-notes+get-86975@lists.php.net to get a copy of this message
Note Submitter: rich at kastle dot com ---- Does anybody else think the "apostrophy-quoted file name" parameter feature is a potential security hole? I'd rather not have to edit user fields to detect this possibility, and I'd rather not have to explain to anyone why they can't put apostrophy-quoted strings in their database. I suggest this modification: pass an opened readable file-handle resource as a parameter instead. (In the meantime, I've patched this feature out of my PHP build.)

« previous php.notes (#86975) next »