note 10286 added to Filesystem Security
| From: | jqj at darkwing dot uoregon dot edu | Date: | Sun, 24 Dec 2000 15:03:16 +0000 |
| Subject: | note 10286 added to Filesystem Security | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-9060@lists.php.net to get a copy of this message | ||
One problem I'm having as a newbie understanding php security is that it depends so heavily on
seemingly small config changes. For example, consider the comments above about HTTP_REMOTE_USER.
If register_globals is set, a cracker can simply pass HTTP_REMOTE_USER as a GET variable; more
generally, the cracker can initialize any variable at all. Moral: a PHP script should never count
on *any* value for an environment or HTTP_* variable.
http://www.php.net/manual/security.filesystem.php