TalkPHP - View Single Post - PHP Injection

delayedinsanity · 07-02-2008, 08:26 PM

Let me clarify my usage of the word dynamic.

Some functions I use require that they may need to include/require a file before they work (my registry, for instance). I cannot use a switch statement for this, as there are too many possibilities, as well as everytime I added a class to the library I would also have to update the switch.

So what I was referring to by dynamic, was the use of an "include $somevar;" statement as opposed to a static "include this/file.tpl". NOT dynamically letting a remote user have any control whatsoever over a file include.

Despite this 'dynamic' method being programmer controlled, I still recommend the use of checks even then for use in debugging. For instance, the following is part of my static load method:

PHP Code:


			
if ( ! class_exists($szClass))
{
    try {
        if ( ! file_exists($szFilename))
            throw new tException("Library file cannot be found: {$szModule}.{$szClass}");
    }
    catch (tException $e) { die($e->tMessage()); }

    require $szFilename;
}

-m

07-02-2008, 08:26 PM	#9 (permalink)
delayedinsanity is cute and cuddly Join Date: Mar 2008 Location: Vegas, Baby Posts: 963 Thanks: 31	Let me clarify my usage of the word dynamic. Some functions I use require that they may need to include/require a file before they work (my registry, for instance). I cannot use a switch statement for this, as there are too many possibilities, as well as everytime I added a class to the library I would also have to update the switch. So what I was referring to by dynamic, was the use of an "include $somevar;" statement as opposed to a static "include this/file.tpl". NOT dynamically letting a remote user have any control whatsoever over a file include. Despite this 'dynamic' method being programmer controlled, I still recommend the use of checks even then for use in debugging. For instance, the following is part of my static load method: PHP Code: `if ( ! class_exists($szClass)) { try { if ( ! file_exists($szFilename)) throw new tException("Library file cannot be found: {$szModule}.{$szClass}"); } catch (tException $e) { die($e->tMessage()); } require $szFilename; }` -m