Codecs can be circumvented

[GoogleCodeExporter]

Creating a file named `Codec.php` anywhere in the `include_path` or in the 
working directory can be used to disable all encoding of all codecs:

<code language="php">
class Codec {
    function __construct() {
    }

    function encode($foo, $s) {
        return $s;
    }
}
</code>

The solution is including the file `Codec.php` from the absolute path in the 
ESAPI codecs. I am sending a patch for it.

Original issue reported on code.google.com by ja...@vrana.cz on 24 Mar 2012 at 12:03

Attachments:

• dirname.patch