It was brought to my attention recently by a reader of the blog that there was a vulnerability in one of my posts (The email sending script). I dismissed it becuase PHP_SELF is a server variable but then he confirmed with a proof of concept.

I think you as programmers should have a look at this. It escaped me and before coming into webdesign i was in security so I should have come across it!

http://blog.pryde-design.co.uk/2008/...e-in-php_self/

Andrew

Disclaimer: I am posting this as a contribution to the forum I would like to think that is a good one so please don't remove it just becuase its posted on my blog I have spoken to jackfranklin about my methods already.