• May 30, 2017

    This code requires allow_url_include=On in your php.ini, which is disabled by default because it’s a MASSIVE SECURITY RISK. This is called the Remote File Include (RFI) vulnerability. If there is PHP code on this site it will be executed on your server.

    Extremely insecure:

    <?php include("http://www.othersite.com/filename.html"); ?>

    What you probably want is:

    <?php print file_get_contents("http://www.othersite.com/filename.html"); ?>

    However, this is technically an XSS vulnerability. So, if you trust the website there isn’t a problem. But you probably want to run Html Purifer before printing it out.



เวอไนน์ไอคอร์ส

ประหยัดเวลากว่า 100 เท่า!






เวอไนน์เว็บไซต์⚡️
สร้างเว็บไซต์ ดูแลเว็บไซต์

Categories