Posted by Brian V Bonini on 05/20/05 23:07

On Fri, 2005-05-20 at 12:51, Mário Gamito wrote:

> Why is this wrong and how to make it right ?

I did this and sent myself a link to it via email, clicked it from
within my email client (Evolution) which launched a browser and called
the script successfully writing the vars to test.txt. Of course this is
not use-able in the real world but it works for testing...

http:/foobar.com/test.php?email=foo@bar.com&code=vu782

<?php

$filename="test.txt";

if(!file_exists($filename)) {
touch($filename);
}

$content = $_GET['email'] . ":";
$content .= $_GET['code'] . "\n";

$fp = fopen($filename, 'ab');
fwrite($fp, $content);
fclose($fp);

header("Location: http://foobar.com/test.txt");

?>


--

s/:-[(/]/:-)/g


Brian GnuPG -> KeyID: 0x04A4F0DC | Key Server: pgp.mit.edu
======================================================================
gpg --keyserver pgp.mit.edu --recv-keys 04A4F0DC
Key Info: http://gfx-design.com/keys
Linux Registered User #339825 at http://counter.li.org

• Next in forum: Re: [PHP] Can I prevent Server variables from being spoofed ?
• Prev in forum: __get() not reentrant?
• Thread view: Re: [PHP] Getting parameters from a URL coming from outside the site

[Reply to this message]