note 78582 added to function.readfile

To avoid the risk of choosing themselves which files to download by messing with the request and doing things like inserting "../" into the "filename", simply remember that URLs are not file paths, and there's no reason why the mapping between them has to be so literal as "download.php?file=thingy.mpg" resulting in the download of the file "thingy.mpg". It's your script and you have full control over how it maps file requests to file names, and which requests retrieve which files. But even then, as ever, never trust ANYTHING in the request. Basic first-day-at-school security principle, that. ---- Server IP: 203.89.181.186 Probable Submitter: 60.234.168.92 ---- Manual Page -- http://www.php.net/manual/en/function.readfile.php Edit -- https://master.php.net/note/edit/78582 Del: integrated -- https://master.php.net/note/delete/78582/integrated Del: useless -- https://master.php.net/note/delete/78582/useless Del: bad code -- https://master.php.net/note/delete/78582/bad+code Del: spam -- https://master.php.net/note/delete/78582/spam Del: non-english -- https://master.php.net/note/delete/78582/non-english Del: in docs -- https://master.php.net/note/delete/78582/in+docs Del: other reasons-- https://master.php.net/note/delete/78582 Reject -- https://master.php.net/note/reject/78582 Search -- https://master.php.net/manage/user-notes.php