$ SERVER['PHP SELF'] unsafe?

[FromBelgium]

I use below function to get the filename:

$menu=basename($_SERVER['PHP_SELF'], '.php');

For example with www.domain.com/example.php it returns value “example”.

However if some enters www.domain.com/example.php/somethingelse/ then it returns value “somethingselse” and not “example”. So $menu can get any value. Can this be used to hack a site?

[penders]

Can this be used to hack a site?

It depends what you are doing with it and to some extent the server config. It's basically user input, so the same validation applies.

If you are just using $menu to highlight a menu item then it might just be a visual disturbance. (But one which could be shared publicly.)

[omoutop]

simple echoing $_SERVER['PHP_SELF'], is vulnerable to XSS attacks. You can find many references for this if you google it.
Best approach is to echo htmlspecialchars($_SERVER['PHP_SELF']);, just to be on the safe side.

[lucy24]

However if some enters www.domain.com/example.php/somethingelse/ then it returns value “somethingselse” and not “example”. So $menu can get any value. Can this be used to hack a site?

Did you mean, if someone enters this spurious URL in their address bar, taking advantage of path-info defaults?

It may be safer to address this from the other side: don't let the site accept URLs with more stuff (other than a query string, duh) after the filename extension. Either block or redirect, depending on circumstances and preference.

[yasar]

ya correct some time its make a way to hack just you entered the file name for example test.php

[default password]

You need to make note of all these:

$_SERVER["SCRIPT_NAME"]
$_SERVER["PATH_INFO"]
$_SERVER["PATH_TRANSLATED"]
$_SERVER["PHP_SELF"]

in your code. Use various URLs in a test script with var_dump($_SERVER);.

P.S. I have never seen/heard of any "hacking" of a site by adding "/text" on a URL.