Posted by amygdala on 08/11/06 15:31

Hi,

I read something about PHP_SELF possibly issuing security flaws, since
requesting...

http://www.mydomain.com/thescript.php/bogus

....would output '/thescript.php/bogus' if PHP_SELF is issued in
thescript.php

Can't seem to find the article anymore though.

What would be a good workaround for this?

__FILE__ isn't an option here cause I would like to issue PHP_SELF / your
suggestion in a class that is included in thescript.php

Is there no native PHP variable that returns the pure filename (no path, no
querystring, no trailing user input, etc.) ?

Thanks a bunch.

[Back to original message]