3 ms·
Was it seriously just echo-ing the raw input to a shell? Wouldn't shock me. How much QA could he have done on an app that was thrown together in response to a
by brk 18y ago
Was it seriously just echo-ing the raw input to a shell?
Wouldn't shock me. How much QA could he have done on an app that was thrown together in response to a web comic posted in the last dozen hours?
Yeah, best practices and all that... But sometimes it's also fun to watch people attempt to exploit things.
- bemmu 18y agoThere was always addslashes there, but I decided to filter out everything else too since I didn't quite know what kind of shell features there are. I know this is not the proper way to pipe input to the say command, but best coding practices weren't exactly on my mind when doing a thing in 5 minutes I didn't know if anyone would even check out =)