RE: [PHP] download script
| From: | Ed Lazor | Date: | Tue, 10 Aug 2004 18:53:37 +0000 |
| Subject: | RE: [PHP] download script | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-193359@lists.php.net to get a copy of this message | ||
The other guys addressed how to get the script working, but I thought I
might also mention that you're presenting a potential security hole in your
app by not filtering the file name before using it. You'll also want to use
the realpath command on the full file name and path.
> -----Original Message-----
> $file = "/home/dlr/test/".$_GET['file']."";