note 55465 added to function.file-exists

this code looks inocent <?php $filename=$_REQUEST["var"]; $filename .= ".data"; file_exist($filename){ include($filename); } ?> but if you pass something like script.php?var=test%00asbs it should really can do bad things like including accesslog files if you replace "test" with something like "../logs/accesslog" ---- Manual Page -- http://www.php.net/manual/en/function.file-exists.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+55465 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+55465&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+55465&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+55465&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+55465&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+55465&report=yes&reason=non-english Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+55465&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+55465&report=yes Search -- http://master.php.net/manage/user-notes.php