note 55068 added to reserved.variables

Warning: $_SERVER['PHP_SELF'] can include arbitrary user input. The documentation should be updated to reflect this. The request "http://example.com/info.php/attack%20here" will run /info.php, but in Apache $_SERVER['PHP_SELF'] will equal "/info.php/attack here". This is a feature, but it means that PHP_SELF must be treated as user input. The attack string could contain urlencoded HTML and JavaScript (cross-site scripting) or it could contain urlencoded linebreaks (HTTP response-splitting). The use of $_SERVER['SCRIPT_NAME'] is recommended instead. ---- Manual Page -- http://www.php.net/manual/en/reserved.variables.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+55068 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+55068&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+55068&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+55068&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+55068&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+55068&report=yes&reason=non-english Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+55068&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+55068&report=yes Search -- http://master.php.net/manage/user-notes.php