Hacker News Reader

Comment by a1a | Hacker News Reader

$url = 'https://hashcash.io/api/checkwork/' . $_REQUEST['hashcashid'] . '?apikey=[YOUR-PRIVATE-KEY]'; $work = json_decode(file_get_contents($url));

Pretty sure this code is vulnerable to local file inclusion. Running file_get_contents on unchecked user input is a terrible idea, even more so coming from a "security solution".

View on HN

How do you turn a prefix of "https://hashcash.io/" into a local file inclusion?

It was quick and dirty example on how to use it. Frameworks usually expose builder function where you can pass query as and array/hash and that should be used. Do you have better example which will be clear about what happening and use pure PHP?

Add:

    if(strspn($_REQUEST['hashcashid'], 'abcdef0123456789-') !=
       strlen($_REQUEST['hashcashid'])
         die('Invalid character.');

Reply on news.ycombinator.com