>include("../../../mainfile.php");
>
>include($phpbb_root_path.'common.'.$phpEx);
>
>...
>
>in mainfile.php at lines 54-56
>
>...
>
>import_request_variables('GPC');Oh, OK - now that makes sense. This looks like one aspect of the "globals overwrite" problem as originally documented by Stefan Esser in the article "$GLOBALS Overwrite and it's Consequences" http://www.hardened-php.net/index.76.html The article mentions extract() as well, and the behavior differs between PHP4 and PHP5. With respect to variables that seem to be cleansed - I've seen this odd behavior once or twice before, but I don't remember the specifics and can't dig up the Bugtraq post :-( - Steve
