note 59127 added to function.readfile

As Grey said below: Readfile will send users un-executed PHP files, which makes it easy to exploit vulnerabilities. It's common - and easy - to use GET variables pointing to downloadable files, like script.php?v=web/file.mov , but this lets users to change it to script.php?v=index.php and get damaging info. Even POST variables can be exploited this way if the user's on a custom browser. To keep secure, limit downloadable files to one directory, like 'web/', so that script.php?v=file.mov will send web/file.mov, and scan the variable for '..' and 'php' to make sure users can't go into other directories, or open php files you may have stupidly put under web/. This should cover all the bases. ---- Manual Page -- http://www.php.net/manual/en/function.readfile.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+59127 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+59127&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+59127&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+59127&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+59127&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+59127&report=yes&reason=non-english Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+59127&report=yes&reason=already+in+docs Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+59127&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+59127&report=yes Search -- http://master.php.net/manage/user-notes.php