https://wiki.webhostingbuzz.com/why-allow_url_include-evil/ [not used] Sat, 11 Jan 2025 20:41:00 +0000 hourly 1 https://wordpress.org/?v=3.9.40 https://wiki.webhostingbuzz.com/why-allow_url_include-evil/#comment-23 Sun, 20 Mar 2016 05:43:00 +0000 https://www.webhostingbuzz.com/wiki/?p=981#comment-23 But if you change the method of the include from GET to POST, the url injection is ignored. Granted, the session cannot be “bookmarked” which removes ease of use depending on what you’re making, but if your application writes to MySQL or another DB any data a user has remains server-side anyway.

]]>