I once jumped-in on a PHP project where the previous developers had written: $page = $_GET['page']; include ($page.".php"); Whilst allow_url_include (

I once jumped-in on a PHP project where the previous developers had written: $page = $_GET['page']; include ($page.".php"); Whilst allow_url_include (http://php.net/manual/en/filesystem.configuration.php#ini.allow-url-include http://php.net/manual/en/filesystem.configuration.php#ini.al...) was set to false, I could still craft a URL like: http://example.com/?page=admin/index http://example.com/?page=admin/index which expanded to http://example.com/index.php?page=admin/index http://example.com/index.php?page=admin/index where the real admin was at http://example.com/admin/index.php http://example.com/admin/index.php and offered complete access to the backend without authentication or authorization - let alone other files in the file system. In another project, I found that the server had register globals turned on, and therefore could craft a URL like: http://example.com/admin?valid_user=1 http://example.com/admin?valid_user=1, where valid_user was a PHP variable set to true iff their session cookie could be authenticated in the database. I think it's terrifying that these things still make it through to production websites