NYCPHP Meetup

[George Schlossnagle]

On Jul 21, 2005, at 8:54 AM, csnyder wrote:

> On 7/20/05, Daniel Convissor <danielc at analysisandsolutions.com> wrote:
>
>
>> More importantly, PHP_SELF can be tainted by users.  Don't assume  
>> it's
>> safe.
>>
>
> Hmm. How does $_SERVER['PHP_SELF'] get tainted by users?

By appending parameters to the uri you're requesting, i.e. requesting

http://example.com/?$BAD_STUFF_HERE

George