Php-null character Issues

Because PHP's file system operation is a C-based function, it may handle Null characters in unexpected ways. The null character is used in the C language to identify the end of the string, and a complete string is from its beginning to meeting the Null character. The following code demonstrates a similar attack:

Example #1 code that will be attacked by a Null character problem

<?php    $file = $_get[' file '];//". /.. /etc/passwd\0 "    if (file_exists ('/home/wwwrun/'. $file. php ')) {        //file/home/wwwrun/. /.. /ETC/PASSWD exists then the File_exists method returns True        include '/home/wwwrun/'. $file. PHP ';        The file/etc/passwd'll be included    }?>

Therefore, any string used to manipulate the file system, especially strings entered by the program, must be properly checked. The following is an improved version of the above example:

Example #2 the correct procedure for validating input

<?php    $file = $_get[' file '];    Whitelist a string check    switch ($file) {case        ' main ': Case '        foo ': Case        ' bar ':            include '/home/wwwrun/ include/'. $file. PHP ';            break;        Default:            include '/home/wwwrun/include/main.php ';    }? >

