Description

Category: Security
include() or analogous function is used with variable argument. This can be dangerous since variables arein many cases controllable by remote users, and may also be altered or overwritten by mistake. This may lead to undesired behavior, and execution or arbitrary code. It is advisable to use constants instead, in such cases.

Example

Dangerous $script_path = "/htdocs";
include($script_path."/foo.inc");
Recommended define('SCRIPT_PATH', "/htdocs");
include(SCRIPT_PATH."/foo.inc");