Re: php - inject code into $_SERVER ?

> My question is now: is there any (known) way for a user to inject
> arbitrary code into this _SERVER global? (and thus execute this code
> on the server with root permissions) or am I not-to-unsafe to use it?

afaik there is no way to inject some garbage in $_SERVER variable (if
this will happen because of a bug in php, many, many admins will have a
daily nightmare; but php had some bugs and nothing is impossible)

of course, it's not paranoid to do some regexep like
^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ before passing it to
system call

Alex