PHP_SELF __FILE__ and the likes

[amygdala]

Hi,

I read something about PHP_SELF possibly issuing security flaws, since
requesting...

http://www.mydomain.com/thescript.php/bogus

....would output '/thescript.php/bogus' if PHP_SELF is issued in
thescript.php

Can't seem to find the article anymore though.

What would be a good workaround for this?

__FILE__ isn't an option here cause I would like to issue PHP_SELF / your
suggestion in a class that is included in thescript.php

Is there no native PHP variable that returns the pure filename (no path, no
querystring, no trailing user input, etc.) ?

Thanks a bunch.

[amygdala]

"amygdala" <no*****@noreply.comschreef in bericht
news:44**********************@news.kpnplanet.nl...

Hi,

I read something about PHP_SELF possibly issuing security flaws, since
requesting...

http://www.mydomain.com/thescript.php/bogus

...would output '/thescript.php/bogus' if PHP_SELF is issued in
thescript.php

Can't seem to find the article anymore though.

What would be a good workaround for this?

__FILE__ isn't an option here cause I would like to issue PHP_SELF / your
suggestion in a class that is included in thescript.php

Is there no native PHP variable that returns the pure filename (no path,
no querystring, no trailing user input, etc.) ?

Thanks a bunch.

I think I found it already:

$_SERVER[ 'SCRIPT_NAME' ]

Seems to work.

Still, if somebody cares to elaborate on the subject: I'm curious what kind
of security issues could show up when using these kinds of variables. Is
$_SERVER[ 'SCRIPT_NAME' ] secure? Much appreciated.

[Tim Hunt]

amygdala wrote:

"amygdala" <no*****@noreply.comschreef in bericht
news:44**********************@news.kpnplanet.nl...

Hi,

I read something about PHP_SELF possibly issuing security flaws, since
requesting...

http://www.mydomain.com/thescript.php/bogus

...would output '/thescript.php/bogus' if PHP_SELF is issued in
thescript.php

Can't seem to find the article anymore though.

What would be a good workaround for this?

__FILE__ isn't an option here cause I would like to issue PHP_SELF / your
suggestion in a class that is included in thescript.php

Is there no native PHP variable that returns the pure filename (no path,
no querystring, no trailing user input, etc.) ?

Thanks a bunch.

I think I found it already:

$_SERVER[ 'SCRIPT_NAME' ]

Seems to work.

Still, if somebody cares to elaborate on the subject: I'm curious what kind
of security issues could show up when using these kinds of variables. Is
$_SERVER[ 'SCRIPT_NAME' ] secure? Much appreciated.

Yeah I read about the PHP_SELF problem recently too , the links below
cover the topic better than I can.

http://blog.phpdoc.info/archives/13-guid.html
http://www-03.ibm.com/developerworks...ver_trust_user

The second page mentions that all variables in $_SERVER which begins
with HTTP (HTTP_REFERER, HTTP_HOST etc) can be easily spoofed.

Regards,
Tim

[amygdala]

"Tim Hunt" <ti********@gmail.comschreef in bericht
news:11**********************@b28g2000cwb.googlegr oups.com...

>
amygdala wrote:

>"amygdala" <no*****@noreply.comschreef in bericht
news:44**********************@news.kpnplanet.nl.. .

Hi,

I read something about PHP_SELF possibly issuing security flaws, since
requesting...

http://www.mydomain.com/thescript.php/bogus

...would output '/thescript.php/bogus' if PHP_SELF is issued in
thescript.php

Can't seem to find the article anymore though.

What would be a good workaround for this?

__FILE__ isn't an option here cause I would like to issue PHP_SELF /
your
suggestion in a class that is included in thescript.php

Is there no native PHP variable that returns the pure filename (no
path,
no querystring, no trailing user input, etc.) ?

Thanks a bunch.

I think I found it already:

$_SERVER[ 'SCRIPT_NAME' ]

Seems to work.

Still, if somebody cares to elaborate on the subject: I'm curious what
kind
of security issues could show up when using these kinds of variables. Is
$_SERVER[ 'SCRIPT_NAME' ] secure? Much appreciated.

Yeah I read about the PHP_SELF problem recently too , the links below
cover the topic better than I can.

http://blog.phpdoc.info/archives/13-guid.html
http://www-03.ibm.com/developerworks...ver_trust_user

The second page mentions that all variables in $_SERVER which begins
with HTTP (HTTP_REFERER, HTTP_HOST etc) can be easily spoofed.

Regards,
Tim

Thanks for those links. Good stuff.

[Robert]

The correct way to get the php file is:

$_SERVER['PHP_SELF'] -- No security vulns. as per my knowledge.

Hope this helps, -Rob
amygdala wrote:

"amygdala" <no*****@noreply.comschreef in bericht
news:44**********************@news.kpnplanet.nl...

Hi,

I read something about PHP_SELF possibly issuing security flaws, since
requesting...

http://www.mydomain.com/thescript.php/bogus

...would output '/thescript.php/bogus' if PHP_SELF is issued in
thescript.php

Can't seem to find the article anymore though.

What would be a good workaround for this?

__FILE__ isn't an option here cause I would like to issue PHP_SELF / your
suggestion in a class that is included in thescript.php

Is there no native PHP variable that returns the pure filename (no path,
no querystring, no trailing user input, etc.) ?

Thanks a bunch.

I think I found it already:

$_SERVER[ 'SCRIPT_NAME' ]

Seems to work.

Still, if somebody cares to elaborate on the subject: I'm curious what kind
of security issues could show up when using these kinds of variables. Is
$_SERVER[ 'SCRIPT_NAME' ] secure? Much appreciated.

[R. Rajesh Jeba Anbiah]

Robert wrote:

The correct way to get the php file is:

$_SERVER['PHP_SELF'] -- No security vulns. as per my knowledge.

<snip>

Read the thread above. The security issue was a big noise sometimes
ago; until that time, I was using $_SERVER['PHP_SELF']; but now using
$_SERVER['SCRIPT_NAME']

--
<?php echo 'Just another PHP saint'; ?>
Email: rrjanbiah-at-Y!com Blog: http://rajeshanbiah.blogspot.com/