Avoiding the PHP_SELF Exploit

Simply escape the variable like this:

PHP Code
$x = htmlentities($_SERVER['PHP_SELF'])


Example application:
PHP Code
<form name="MyForm" action="<?php echo htmlentities($_SERVER['PHP_SELF']); ?>" method="post">

Last edited by Russ; 12/02/19 06:33 PM.
The Captian
Today they call you "crazy". Tomorrow they call you "ahead of your time."
Global Skywatch Learn about Chemtrails - You're breathing them now!
OnlyTheBestHerbs.com World-class supplements
Mercury Talk Why you are sick.
OneUp Domains Domains, Hosting, Email
1-800-358-4278 (U.S. & Canada)