RE: [PHP4BETA] cat /etc/passwd

> You can prevent this by having safe_mode_exec_dir > empty and safe_mode set to 'On' in your php.ini : > > safe_mode=On > safe_mode_exec_dir= > > Then, php refuses to system() commands that are not explicitly > set in safe_mode_exec_dir, refuses to executes with backquotes, > ans also checks that the files you want to fopen are owned by the > same uid as the script you're executing. Turning safe mode on (with PHP as a module) has other implications. PHP loses some functionality, which I consider a major (and unneccessary) tradeoff, just to safeguard a file that can be protected in other ways (which also lends itself to greater overall system security). Mike Robinson