Not the kind of article i would expect from o'reilly!

Article:		Ten Security Checks for PHP, Part 1
Subject:		Not the kind of article i would expect from o'reilly!
Date:		2005-02-06 13:52:17
From:		ClancyMalcolm
Response to: Not the kind of article i would expect from o'reilly!
"Obviously, you assume that www.some-BAD-site.com is running php." No, in fact it is assumed that www.some-BAD-site.com is NOT running PHP and it provides raw PHP code to the server that runs the include statement. This is the essence of this security risk - the PHP engine will execute PHP code loaded from a different web site.