note 51275 deleted from function.odbc-execute by nlopess
| From: | nlopess@php.net | Date: | Fri, 25 Mar 2005 14:10:05 +0000 |
| Subject: | note 51275 deleted from function.odbc-execute by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-86975@lists.php.net to get a copy of this message | ||
Note Submitter: rich at kastle dot com
----
Does anybody else think the "apostrophy-quoted file name" parameter feature is a potential
security hole? I'd rather not have to edit user fields to detect this possibility, and
I'd rather not have to explain to anyone why they can't put apostrophy-quoted strings in
their database.
I suggest this modification: pass an opened readable file-handle resource as a parameter instead.
(In the meantime, I've patched this feature out of my PHP build.)