will run /info.php, but in Apache $_SERVER['PHP_SELF'] will equal /info.php/attack here . This is a feature, but it means that PHP_SELF must be treated as user input. The...www.php.net
You may be confused, as I was, by the instructions for installing cURL in php. The instruction To use PHP's cURL support you must also compile PHP --with-curl[=DIR]... was mur...www.php.net