File inclusion vulnerability (Unix system) WASC Thre exists in the application

The upstairs way of replacing $_ REQUEST is not suitable for some situations. Call this function at the top of your page to convert_req ($_ REQUEST)

Provide functions:

/ / request transcoding

Function convert_req ($req)

{

Foreach ($req as $k = > $v)

{

If (is_array ($v))

{

Convert_req ($req [$k])

}

Else

{

If (! is_u8 ($v))

{

$req [$k] = iconv ("gbk", "utf-8", $v)

}

$req [$k] = trim ($req [$k]); / / $s is the parameter to be filtered

$req [$k] = strip_tags ($req [$k], ""); / / clear codes such as HTML

$req [$k] = str_replace ("\ n", ", str_replace (", ", $req [$k])); / / remove spaces and line feeds

$req [$k] = str_replace ("\ t", "", $req [$k]); / / remove tabulation symbols

$req [$k] = str_replace ("\ r\ n", "", $req [$k]); / / remove the enter feed symbol

$req [$k] = str_replace ("\ r", "", $req [$k]); / / remove enter

$req [$k] = str_replace ("'", "", $req [$k]); / / remove single quotation marks

$req [$k] = str_replace (".. /", ", $req [$k]); / / remove".. / "

$req [$k] = trim ($req [$k])

}

}

}