Re: [Full-disclosure] noise about full-width encoding bypass?

[ascii <ascii@xxxxxxxxxxxx>]

Brian Eaton wrote:
> To summarize what I've heard from various sources: I am missing
> something important. =)  Both PHP and ASP.NET will decode these
> characters into their ASCII equivalents.

(AFAIK)

Only ASP.NET/IIS decodes that automatically.

PHP *can* do that as like JSP and probably others but that has
to happen explicitly in the application code or on an other layer.

Regards,
Francesco `ascii` Ongaro
http://www.ush.it/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/