Re: [PHP] Remote File Variable Injection Safety?

c...@l-i-e.com wrote: If register_globals is "on" (ewww!) at otherhost.com, then "?safe_flag" on the URL will get in. This is one of the reasons why register_globals should be OFF. NOTE: The code you gave does not describe the circumstances whereby $safe_flag is "set". There could be all man

Re: [PHP] Remote File Variable Injection Safety?

If register_globals is "on" (ewww!) at otherhost.com, then "?safe_flag" on the URL will get in. This is one of the reasons why register_globals should be OFF. NOTE: The code you gave does not describe the circumstances whereby $safe_flag is "set". There could be all manner of other issue

Re: [PHP] Remote File Variable Injection Safety?

2009/1/7 Daniel Kolbo : > suppose there is a file at http://otherhost.com/remote.php that looks like > this: > > if (!isset($safe_flag)) > { > die("hacking attempt"); > } > echo "You are in"; > ?> > > Suppose i executed the following php file at http://myhost.com/local.php > > require_once("htt

[PHP] Remote File Variable Injection Safety?

Hello, suppose there is a file at http://otherhost.com/remote.php that looks like this: Suppose i executed the following php file at http://myhost.com/local.php http://otherhost.com/remote.php";); ?> Is there any way to get local.php to display "You are in", by only modifying local.php?