On Wed, Nov 3, 2010 at 4:00 PM, Chip Bennett <span dir="ltr"><<a href="mailto:chip@chipbennett.net" target="_blank">chip@chipbennett.net</a>></span> wrote:<br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Found this in another Theme:<blockquote style="margin:0 0 0 40px;border:none;padding:0px"><div><span style="font-family:'Times New Roman';font-size:medium"><pre style="word-wrap:break-word;white-space:pre-wrap">Copyright <?php echo date('Y') . ' ' . substr($_SERVER['HTTP_HOST'], 4, 100); ?></pre>
</span></div></blockquote><div>I don't know what it's trying to do, other than pull something out of the HTTP header...</div></blockquote><div><br></div><div>This is unsafe and potentially insecure. All $_SERVER variables must never be printed without being escaped.</div>
<div><br></div><div>This needs to either have esc_html() applied to it, or preferably replaced with site_url(), or even better, bloginfo('name'), which is what it's meant for.</div><div><br></div><div>Here's some reading: <span class="Apple-style-span" style="font-family: Helvetica; font-size: 12px; "><a href="http://markjaquith.wordpress.com/2009/09/21/php-server-vars-not-safe-in-forms-or-links/">http://markjaquith.wordpress.com/2009/09/21/php-server-vars-not-safe-in-forms-or-links/</a>.</span></div>
<div><br></div><div>Nacin</div>
</div>