Question

Let’s say I have a text file. It contains “harmfull” code like:

<?php phpinfo(); ?>

or it could be anything else, SQL injection code, html links etc…

Now here is my example script:

$content = file_get_contents('harmfullcode.txt');

Now obviously $content variable will store that harmfull code.

My question is, is it safe to store such information in a variable?

I know for example if I

echo $content;

then it WILL be harmfull.

But if I don’t do anything with the variable, is it safe for the variable to hold any type of harmfull code?

Edited to make it more clear:

What is the difference between this?

$content = file_get_contents('harmfullcode.txt');
$safevar = removebadstuff($content);
echo $safevar;

VS

$content = removebadstuff(file_get_contents('harmfullcode.txt'));
echo $content;

the second example removes bad stuff before assigning it to $content…?? I’m kind of new to php security, trying to grasp the concept. Thank you.

Answer 1

hey are nearly identical. You might want to unset $content in the first example as the second example only creates the local variable as the first parameter of removebadstuff.

Keep in mind that strings in PHP are binary-safe.

Required reading: The ultimate clean/secure function