Skip to content

Instantly share code, notes, and snippets.

@lorenzoferrarajr
Last active January 19, 2016 21:45
Show Gist options
  • Save lorenzoferrarajr/ec3ea9404fbd392b9810 to your computer and use it in GitHub Desktop.
Save lorenzoferrarajr/ec3ea9404fbd392b9810 to your computer and use it in GitHub Desktop.
Demo showing the danger of using PHP's include statement
<?php
$variable = 'include';
return $variable;
<?php
$includeFunction = function($file) { return include $file; };
$variable = 'original';
$config = include "include.php";
var_dump($variable, $config); // include, include
$variable = 'original';
$config = $includeFunction("include.php");
var_dump($variable, $config); // original, include
$variable = 'original';
$config = [
'uhm' => include "include.php",
];
var_dump($variable, $config); // include, [uhm] => include,
$variable = 'original';
$config = [
'uhm' => $includeFunction("include.php"),
];
var_dump($variable, $config); // original, [uhm] => include
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment