NYCPHP Meetup

[Chris Shiflett]

cliff wrote:
> You have opened a can of worms. If PHP_SELF can be tainted, are
> you saying we shouldn't use it? It's such a valuable tool. HOw
> can we guarantee it's integrity?

To answer a question with a question, everything you receive from the 
user is tainted, so should you not use any of it? :-)

Dan is just pointing out the fact that you should filter it first. With 
the way Michael is using it, an attacker could potentially send a string 
with a \r\n in it to send additional HTTP headers of the attacker's 
choosing.

Chris

-- 
Chris Shiflett
Brain Bulb, The PHP Consultancy
http://brainbulb.com/