Apols if this has been asked before. I am using someone else's PHP code and 开发者_JS百科came across the following line:
if($_GET['file']{0}=='.') die('Wrong file!');
The if, $_GET and die I understand, but what is the meaning of the {0} after the $_GET['file']? I've looked through a number of tutorials and didn't come across the answer.
TIA.
$str{0}
will return the first character/byte of a string. But the syntax $str{0}
is deprecated in favor of $str[0]
:
Note: Strings may also be accessed using braces, as in
$str{42}
, for the same purpose. However, this syntax is deprecated as of PHP 5.3.0. Use square brackets instead, such as$str[42]
.
If you’re working with multi-byte characters, use mb_substr
instead.
The {0}
is the same as [0]
. So, $_GET['file']{0}
is getting the zeroth character from $_GET['files']
.
It's shorthand for accessing the first character of the string. $_GET['file']{1} would be the second character, and so on. So in your example it's checking to see whether the first character is a dot, and if so, exiting; presumably to avoid people passing paths in the URL such as ../../../etc/passwd.
As others have said, it's looking at string position 0 in the variable $_GET['file'] and throwing an error if that happens to be a dot.
This looks like a (relatively crude) way of preventing hack attacks by blocking the user if he tries to access a file that starts with a dot.
精彩评论