Re: php - inject code into $_SERVER ?

http://fr.php.net/manual/en/reserved.variables.php#reserved.variables.server:
"The entries in this array are created by the webserver"


As for me it does mean that what was written: copy of runtime array created
by server for each execution and if somebody has some way to inject any data
in $_SERVER it does mean that somebody has control on your server or there
is an error in your code.



In the first case nothing will save you since this somebody can do, at
least, as much as you: execute any code with servers rights. Why to spend
time on injection if code could be executed directly?

In the second case speech is about the same:  Why to spend time on injection
if code could be executed directly?

> My question is now: is there any (known) way for a user to inject
> arbitrary code
> into this _SERVER global? (and thus execute this code on the server
> with root permissions)
> or am I not-to-unsafe to use it?
>
> Should I perform some more checks on the $_SERVER['REMOTE_ADDR']
> before using it as argument?
>
>
> Thanks for the comments.