06-05-2008, 02:14 PM
(This post was last modified: 06-05-2008, 02:30 PM by cheesedoodles.)
display.php doesnt validate properly, send it this and you expose an include();
I think it may be a good idea to strengthen the input validation on the file variable?
display.php?file=file_name.png" /><!--
perhaps use this:
<?php
$file = preg_replace('/[^a-z0-9_\.]/', '', $_GET['file']);
?>
that way only valid characters get through
Even better would be to associate images with an image ID stored in a database and send that ID instead of a filename, its a few more lines of code, but worth it...
I think it may be a good idea to strengthen the input validation on the file variable?
display.php?file=file_name.png" /><!--
perhaps use this:
<?php
$file = preg_replace('/[^a-z0-9_\.]/', '', $_GET['file']);
?>
that way only valid characters get through
Even better would be to associate images with an image ID stored in a database and send that ID instead of a filename, its a few more lines of code, but worth it...