Justtechjobs.com Find a programming school near you






Online Campus Both


php3-list | 199901

Re: [PHP3] Disable phpinfo? From: Alex Belits (abelits <email protected>)
Date: 01/21/99

On Thu, 21 Jan 1999, John Coggeshall wrote:

> Is it possible to disable the phpinfo() function? Or at least make it so it
> doesn't show the variables being used. I would like to write a script which
> works "behind the scenes" as a gateway between the user and a global
> database and I don't want some malicious user using phpinfo() to find the
> passwords to the database

  phpinfo() is absolutely irrelevant -- when user calls phpinfo(), he can
only get data already available to him, so if user will be able to run his
own php source along with authenticated session with database, or with
some other user's request when another user is authenticated, he will be
able to find out the password regardless of phpinfo() being available or
not just because it's in his variables. And why any user will need to find
any "hidden" password if he will be able just call any function over the
database. You need to redesign your program in a way that user will not be
granted any access to database that he is not supposed to have, and user's
scripts will not be called with passwords passed to them. 

-- 
Alex

----------------------------------------------------------------------
 Excellent.. now give users the option to cut your hair you hippie!
                                                  -- Anonymous Coward

--
PHP 3 Mailing List   http://www.php.net/
To unsubscribe send an empty message to php3-unsubscribe <email protected>
To subscribe to the digest list:  php3-digest-subscribe <email protected>
For help: php3-help <email protected>  Archive:  http://www.php.net/mailsearch.php3
List administrator:  zeev-list-admin <email protected>