Can DOCUMENT ROOT be hacked?

in $_SERVER

[idfer]

I know HTTP_REFERER, HTTP_USER_AGENT, QUERY_STRING and REQUEST_URI in $_SERVER all contain data that can be manipulated by the user, but what about the other values in $_SERVER? Assuming i've got register_globals off, if i use statements like:

include $_SERVER['DOCUMENT_ROOT'].'/myincludefile';

Can a hacker override that variable somehow and redirect my includes to their own server? My intuition says no, but the question does keep me up some nights. :)

[dreamcatcher]

Hi idfer,

No, this should be pretty secure. It was why superglobals were introduced. So, the system knows the data is coming from the server its running on. Its always going to default to the value on your server and cannot be overwritten.

dc