0

I'm not sure if this is a valid way how to filter LFI, because if you bypass in_array function you can include any file, for example /etc/passwd.

Is it possible to bypass in_array function?

<?php
$file = $_GET['file'];
$files = array("some", "files", "here");

if (in_array($file, $files, true)) {
   include('directory/' . $file);
   echo "In array \n";
} else {
   echo "Not in array \n";
}
?>
schroeder
  • 123,438
  • 55
  • 284
  • 319
Kiwi501987
  • 3
  • 1

1 Answers1

0

Looks good, the in_array methodology is valid, especially since you enabled strict matching.

belkarx
  • 1,207
  • 2
  • 18