Author Archives: Daniel Serodio

I’m auditing some PHP code for a friend, and there are a couple of file_get_contents usages for GETting URLs where the user-supplied parameters are concatenated without any escaping, e.g.:

function getLocation($latitude=”, … Continue reading Is using `file_get_contents` on a URL with concatenated parameters secure?→