Re: php - inject code into $_SERVER ?

----- Original Message ----- 
From: "exon" <[email protected]>

>> Don't trust any input from the user or their browser.
>>
>
> Exactly. But trust the input from the server. You don't have much choice 
> anyway, so it's a waste of time bothering about it.


I disagree.  You never know when a new vulnerability will pop up somewhere - 
maybe there's not a vulnerability today, but maybe there'll be one tomorrow. 
Maybe it won't require "ownership" of a webserver, maybe it'll be bad 
handling of data that wouldn't affect anything but software using those 
SERVER variables...  It's _never_ a waste of time to ask yourself whether or 
not a variable is safe, and since it's coming from _outside_ of _your_ code, 
what's the trouble with adding a single line to check the contents of the 
variable?

!c