[wp-hackers] Page with only articles from category x.
wordpress at tekartist.org
Thu Aug 30 03:21:19 GMT 2007
On Aug 29, 2007, at 23:12, Stephane Daury wrote:
> On Aug 29, 2007, at 13:19, Alex Polite wrote:
>>> While these aren't necessarily the best use of them, IMO, if you
>>> to make a single Page that does PHP code, this is the best way.
>>> PHPExec and runPHP and such should be avoided unless absolutely
>> For security reasons or?
> Allowing PHP code in a page or post content (or any user-modifiable
> content) is begging for injection attacks, which is when someone
> finds a way to execute code on your server from the comfort of
> their web browser.
> Never a good thing.
> Imagine if I could pass the following command to your server?
> <php echo file_get_contents('/etc/passwd').file_get_contents('/etc/
> shadow'); ?>
> Now I'd have access to your box withy the help of any widly
> available quick password cracker.
> This is only compounded by the widespread use of non-SSL login by
> WordPress users.
Though technically, all users are executing code when accessing
I meant "when someone finds a way to execute **their own** code on
More information about the wp-hackers