Re: php - inject code into $_SERVER ?

> > Maybe it's a good idea to also parse the dhcp leases to check that the
> > ip has been attributed by the dhcp server...

Could you use the DHCPLEASEQUERY option for this?

http://www.ietf.org/internet-drafts/draft-ietf-dhc-leasequery-07.txt

I've been doing some PHP code audits in recent months and have been
amazed at the number of projects that blindly trust client input.
Simply by asking this question, you're ahead of the game. Always
assume the worst, that some determined hacker has created a custom
browser and has the ability to insert environment and cookie variables
of her own choosing. Don't trust any input from the user or their
browser.

Good luck.

-- 
Dave Hull
[email protected]