Re: Security of PHP code

> <? > $allowed_path = "/www/sites/mysite/teaching"; > > if (substr($file, 0, str_len($allowed_path)) <> $allowed_path ) > { > die("not allowed!"); > } > else > { > show_source($file); > } > ?> I've missed part of the discussion, but if my understanding of the issue is correct (accepting a filename and path from a visitor to the site to display through a PHP script), then this solution is probably inadequate... If the user passes in a string like /www/sites/mysite/teaching/../../../../etc/passwd, the first part of the string will pass your validity test, but the user may still be able to ascend to a place where files you don't wish to share are stored. A better solution may be to pass the filename through some filter and then concatenate that to your path. For example: if(preg_match("/[^A-Za-z0-9]/", $file)) { die("Invalid filename."); } else { show_source($path . $file); } That's an awefully strict way to do it, but that's my personal preference. If you must accept information that contains a path, perhaps just check for '..' in the user input. Anyways, like I say I could be way off base as far as what the discussion is actually about, and I haven't had near enough coffee this morning, so forgive me if I'm just talking nonsense =)