No, this text event (or better: this write statement) cannot be exploited. But, in another event where you're gonna read the page, you MUST use the n parameter (like in $read(page.txt, n, ....) to prevent any commands in the page text being evaluated.

Edit: I just read Rock's reply. I am not sure whether $findfile is being eveluated during a write operation, but if so he is right that it can be dangerous! Test this one carefully, but replace the remove command in the timer by some echo command, otherwise you're in trouble.

Last edited by noMen; 16/09/07 02:55 PM.