note 56732 added to function.file-exists

Also while using the file_exists file, please make sure you do not start using stuff like, <?php if(file_exists($_GET['file'] . '.php')) { include($_GET['file'] . '.php'; } ?> you could use something like this.. <?php $inrep = "./"; $extfichier = ".php"; $page = $inrep.basename(strval($_REQUEST["page"]),$extfichier).extfichier; if(file_exist($page)) { include($page); } ?> or even hardcode it. So since pretty much all commercial server(s) have url_fopen on.. you can imagine that file_exists($_GET['file']. '.php') is rather .. unsecure :) -David Coallier ---- Manual Page -- http://www.php.net/manual/en/function.file-exists.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+56732 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+56732&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+56732&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+56732&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+56732&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+56732&report=yes&reason=non-english Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+56732&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+56732&report=yes Search -- http://master.php.net/manage/user-notes.php