Re: security

Lukas Smith wrote:

I search on PEAR reveals alot of usage of PHP_SELF in examples and library code as well. I suggest that everybody give their packages a look and make sure that they are using PHP_SELF for one of the few proper reasons or change to SCRIPT_NAME when not.

While I agree that everyone should review their packages, moving to $_SERVER['SCRIPT_NAME'] is not appropriate, IMO. The variables in $_SERVER are SAPI-dependent, and you know that your code works with $_SERVER['PHP_SELF'], but aren't entirely sure that it will with $_SERVER['SCRIPT_NAME'] -- perhaps some of your users run under the aolserver SAPI which (at quick glance of the source) seems to not implement $_SERVER['SCRIPT_NAME'] (but does implement PHP_SELF). The best practice, here, IMO, is to escape (htmlentities(), or urlencode()) $_SERVER['PHP_SELF'] on output. Remember, it's not important to deliver a nicely rendered/properly functioning page to someone who is deliberately screwing with the URL; it's only important to avoid arbitrary HTML output (allowing XSS attacks). I'm by no means a SAPI expert, though, so if I'm wrong, please correct me and accept my apology, in advance. S