Hacker News new | past | comments | ask | show | jobs | submit login

A single file named `index.php` that loads a bunch of text files and spits out what looks vaguely like a blog.

It's a total mess. Business logic and HTML snippets scattered everywhere. Layers of caching to make the whole thing load in less than 0.03 seconds on cheap shared hosting. I'm sure I do a much better job for paying clients, but somehow never get around to fixing the decade-old garbage that runs my own site.

At least it doesn't have any SQL injection vulnerabilities :p




Could still be if file_exist then read file despite where or what file , it's the 2nd most common security hole I have seen behind sql injection.


The script just preloads every file in a hard-coded directory into an associative array and uses isset() to check if the requested post exists. So no arbitrary file access, either.




Join us for AI Startup School this June 16-17 in San Francisco!

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: