php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #10323 4.05-dev : non-html escaped strings on phpinfo
Submitted: 2001-04-13 23:10 UTC Modified: 2001-05-06 11:23 UTC
From: bene at iolvegas dot com Assigned:
Status: Closed Package: PHP options/info functions
PHP Version: 4.0 Latest CVS (13/04/2001) OS: linux 2.4
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: bene at iolvegas dot com
New email:
PHP Version: OS:

 

 [2001-04-13 23:10 UTC] bene at iolvegas dot com 
The PHPinfo() outputs data without running htmlspecialchars()

For example:
http://www.ispep.cx/phpinfo.php?<script>window.location='http://www.php.net';</script>

Keep up the great work, PHP is great!

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2001-05-06 11:23 UTC] sniper@php.net 
Fixed in CVS.

--Jani
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Tue May 06 14:01:28 2025 UTC