English 中文(简体)
问题,美元
原标题:Problem with $_GET and fopen
  • 时间:2011-04-13 13:37:47
  •  标签:
  • php

我对<代码>_GET方法有问题。 我有这样一部《任择议定书》:

$fopen("files/" . $_GET[ file ], "r");

当一字书写文件时,我就自称。 情况良好,但当我从“GET”方法获得档案名称时,我发现,像这条道路一样有些错误是错误的。

  1. What s wrong with it ?
  2. Is there any special encoding for $_GET method to decode it to the right string style. I tried urldecode but it wasn t make any change.
最佳回答

Don t EVER在未经验证的情况下使用用户投入,特别是在主机上不开放档案! 我怎么说都不为过。 如果有人进入GET,在你的申请中说明其价值。

问题回答

Number one rule is to sanitize your input. Using $_GET like that is just asking for trouble. Do the right thing. Put the $_GET value into a variable, verify that it is valid input THEN try to open the file.

As said at the bottom:

  1. Try to dump the $_GET with print, print_r or var_dump
  2. Try to sanitize the input
  3. Remove the leading $ in your code (**$**fopen)
  4. Test if file exists in the specified directory with if(is_file($path)
  5. Isn t the problem caused by file extencion or permissions?

可能更多。 这还取决于你所使用的系统(Win, Unix, Mac)。





相关问题
Brute-force/DoS prevention in PHP [closed]

I am trying to write a script to prevent brute-force login attempts in a website I m building. The logic goes something like this: User sends login information. Check if username and password is ...

please can anyone check this while loop and if condition

<?php $con=mysql_connect("localhost","mts","mts"); if(!con) { die( unable to connect . mysql_error()); } mysql_select_db("mts",$con); /* date_default_timezone_set ("Asia/Calcutta"); $date = ...

定值美元

如何确认来自正确来源的数字。

Generating a drop down list of timezones with PHP

Most sites need some way to show the dates on the site in the users preferred timezone. Below are two lists that I found and then one method using the built in PHP DateTime class in PHP 5. I need ...

Text as watermarking in PHP

I want to create text as a watermark for an image. the water mark should have the following properties front: Impact color: white opacity: 31% Font style: regular, bold Bevel and Emboss size: 30 ...

How does php cast boolean variables?

How does php cast boolean variables? I was trying to save a boolean value to an array: $result["Users"]["is_login"] = true; but when I use debug the is_login value is blank. and when I do ...

热门标签