PHP :: Bug #10323 :: 4.05-dev : non-html escaped strings on phpinfo

Bug #10323	4.05-dev : non-html escaped strings on phpinfo
Submitted:	2001-04-13 23:10 UTC	Modified:	2001-05-06 11:23 UTC
From:	bene at iolvegas dot com	Assigned:
Status:	Closed	Package:	PHP options/info functions
PHP Version:	4.0 Latest CVS (13/04/2001)	OS:	linux 2.4
Private report:	No	CVE-ID:	None

View Add Comment Developer Edit

[2001-04-13 23:10 UTC] bene at iolvegas dot com

The PHPinfo() outputs data without running htmlspecialchars()

For example:
http://www.ispep.cx/phpinfo.php?<script>window.location='http://www.php.net';</script>

Keep up the great work, PHP is great!

Patches

Add a Patch

Pull Requests

Add a Pull Request

History

AllCommentsChangesGit/SVN commitsRelated reports

[2001-05-06 11:23 UTC] sniper@php.net

Fixed in CVS.

--Jani

	php.net \| support \| documentation \| report a bug \| advanced search \| search howto \| statistics \| random bug \| login
go to bug id or search bugs for


Copyright © 2001-2024 The PHP Group All rights reserved.	Last updated: Tue May 07 15:01:36 2024 UTC