131 reputation
3
bio website phpdeveloper.org
location
age
visits member for 1 year, 9 months
seen Jul 23 at 14:23

Jul
16
comment Is php DOMDocument::loadXML completely secure?
Relevant: websec.io/2012/08/27/Preventing-XXE-in-PHP.html
Jul
16
comment PHP Object Injection Prevention - OWASP
Relevant: websec.io/2014/06/13/… (see the section on "Poor unserialize handling")
May
27
comment Directory names using extensions a security risk?
I'm not sure I quite understand the question - it looks like you're asking about directory names, but then you mention naming a file with a ".php" extension. Directories named like "something.php" aren't bad, but don't allow users to define actual files with ".php" extensions on them...that's just asking for trouble. If you're going to allow users to define the name of the file for the template, I wouldn't use that directly as a file name. You could also potentially open yourself up to directory traversal or a RFI if you're not careful.