From 1314e912e5ddfdb1ed19f87c6cbcf19b69384257 Mon Sep 17 00:00:00 2001
From: kikisslass <72187261+kikisslass@users.noreply.github.com>
Date: Thu, 1 Oct 2020 12:20:05 +0530
Subject: [PATCH] Update README.md
---
README.md | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/README.md b/README.md
index 6ba80d0..7e8ff56 100644
--- a/README.md
+++ b/README.md
@@ -8,7 +8,7 @@
-As with many exploits, remote and local file inclusions are only a problem at the end of the encoding. Of course it takes a second person to have it. Now this article will hopefully give you an idea of protecting your website and most importantly your code from a file iclusion exploit. I’ll give code examples in PHP format.
+As with many exploits, remote and local file inclusions are only a problem at the end of the encoding. Of course, it takes a second person to have it. Now, this article will hopefully give you an idea of protecting your website and most importantly your code from a file iclusion exploit. I’ll give example codes in PHP format.
Let’s look at some of the code that makes RFI / LFI exploits possible.
@@ -20,13 +20,13 @@ include ($ page);
?>
```
-Now obviously this should not be used. The $ page entry is not fully cleared. $ page input is directed directly to the damn web page, which is a big “NO”. Always remove any input passing through the browser. When the user clicks on “File” to visit “files.php” when he visits the web page, something like this will appear.
+Obviously this should not be used. The $ page entry is not fully cleared. $ page input is directed directly to the damn web page, which is a big “NO”. Always remove any input passing through the browser. When the user clicks on “File” to visit “files.php” when he visits the web page, something will appear like this.
```
http: //localhost/index.php? page = files.php
```
-Now if no one has cleared the input in the $ page variable, we can have it pointed to what we want. If hosted on a unix / linux server, we can display the password as configuration files for shaded or uncleaned variable input.
+Now, if no one has cleared the input in the $ page variable, we can have it pointed to what we want. If hosted on a unix / linux server, we can display the password as configuration files for shaded or uncleaned variable input.
Viewing files on the server is a “Local File Inclusion” or LFI exploit. This is no worse than an RFI exploit.