note 102519 added to function.curl-setopt

When using CURLOPT_POSTFIELDS with an array as parameter, you have to pay high attention to user input. Unvalidated user input will lead to serious security issues.

<?php

/**
 * test.php:
 */
$ch = curl_init('http://example.com');

curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, array(
    'foo' => $_GET['bar']
));

curl_exec($ch);

?>

Requesting "test.php?bar=@/home/user/test.png" will send "test.png" to example.com. 
Make sure you remove the leading "@" from user input.
----
Server IP: 69.147.83.197
Probable Submitter: 91.64.81.212
----
Manual Page -- http://www.php.net/manual/en/function.curl-setopt.php
Edit        -- https://master.php.net/note/edit/102519
Del: integrated  -- https://master.php.net/note/delete/102519/integrated
Del: useless     -- https://master.php.net/note/delete/102519/useless
Del: bad code    -- https://master.php.net/note/delete/102519/bad+code
Del: spam        -- https://master.php.net/note/delete/102519/spam
Del: non-english -- https://master.php.net/note/delete/102519/non-english
Del: in docs     -- https://master.php.net/note/delete/102519/in+docs
Del: other reasons-- https://master.php.net/note/delete/102519
Reject      -- https://master.php.net/note/reject/102519
Search      -- https://master.php.net/manage/user-notes.php