问题:

I'm thinking of using PHP_SELF to grab the name of the page the user is currently visiting. I'm well aware of the dangers of using PHP_SELF in places like form actions, though I'm not sure where it would hurt to use in hrefs? But that's beside the main question . . . anyway.

Are there any dangers in using PHP_SELF to grab the page the user is on and using str_replace() to get the info I need from it? I can't think of any, but this is, of course a great place to ask. ;)

Thanks!

回答1:

Yes, it can be because it is an attacker controlled variable. It can lead to vulnerabilities such as xss.

<?php print $_SERVER['PHP_SELF']?>

http://localhost/self.php/<script>alert(1)</script>

If possilbe you should use a variable that the attacker can't control like $_SERVER["SCRIPT_FILENAME"]. There are a couple of others, just check the phpinfo().

回答2:

Well if you need the whole URL check out this tutorial. Otherwise, use $_SERVER['REQUEST_URI'] to get the URI of the current page (if the url is example.com/foo/bar.php it will give you foo/bar.php).