note 57144 rejected from function.get-magic-quotes-gpc by jome
| From: | jome@php.net | Date: | Sun, 25 Sep 2005 09:30:53 +0000 |
| Subject: | note 57144 rejected from function.get-magic-quotes-gpc by jome | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-95743@lists.php.net to get a copy of this message | ||
Note Submitter: znoob2 at yahoo dot com
----
With magic quotes gpc turned on, I found that a filenames that have a single quote in their names
get through only partially.
Eg. I have a file: "evil'file.txt".
$_FILES['file']['name'] returns: "file.txt".
Since the "evil'" part is totally stripped off, there is no way of restoring this. So
watch out.