PHP filter $ _SERVER ['PHP_SELF']

Question

PHP filter $ _SERVER ['PHP_SELF']

I need to filter out the untrusted $ _SERVER ['PHP_SELF'] varialbe. This is a good approach:

function filterPhpSelf($str) 
{
    $phpself = basename(__FILE__);
    $str = substr($str, 0, strpos($str,$phpself)) . $phpself;
    return $unsafeStr;
}

where $ str is $ _SERVER ['PHP_SELF']?

0

security php

AquinasTub 05 May '09 at 13:20

source to share

2 answers

troelskn · Answer 1 · 2009-05-05T13:54:08+0000

1) Your code will throw an error on startup.

2) $_SERVER['PHP_SELF']

unsafe. Unsafe use is unsafe.

Amin Amini · Answer 2 · 2009-05-05T14:07:23+0000

Yes, it will work. Though you might want to change:

return $unsafeStr;

to

return $str;

PHP filter $ _SERVER ['PHP_SELF']

More articles: