note 60176 deleted from function.readdir by tularis

Note Submitter: info [AT] thijsbaars [DOT] NL ---- wrote this piece. I use it to validate my $_GET variables. It firsts gets the variable $page, cheks if that variable is assinged (on the main index, it is not). if it is assinged, it checks if it equals one of the found directory's, and then i assigns the variable definatly. this is a rather secure way of validating the $_GET variable, which on my site should only have the name of one of my directory's. <?php $page = $_GET['a']; if ($page != "" || !empty($page)) { $handle=opendir('albums'); while (false!==($file = readdir($handle))) { if (substr($file,0,1)!=".") //do not look up files or directory's which start with a dot { if(!eregi("thumb",$file)) // all files and dir's containign the word thumb are filtred out { $path = "albums/" . $file; if(is_dir($path)) // only directory's will get listed { if($page != $file) die("wrong argument! only a existing album may be set"); // validates input else { $page = "albums/" . $page; $thumb = $page . thumb; } } } } } closedir($handle); }