note 108886 added to security.filesystem

you should check requested file name for back path.a person can delete your code file by going back to root directory. for ex:- deletefile.php?file=../index.php if no proper check for / or \ any user can delete your index page or any usefull file. you may use following function to check for back path. function existBackPath($file){ $file=str_replace("\\","/",$file); return preg_match('[\/]', $file); } if existBackPath function returns 1.It means someone is trying to delete file which does not exist in his/her directory rather it exist in your root directory. ---- Server IP: 69.147.83.197 Probable Submitter: 122.176.159.225 ---- Manual Page -- http://www.php.net/manual/en/security.filesystem.php Edit -- https://master.php.net/note/edit/108886 Del: integrated -- https://master.php.net/note/delete/108886/integrated Del: useless -- https://master.php.net/note/delete/108886/useless Del: bad code -- https://master.php.net/note/delete/108886/bad+code Del: spam -- https://master.php.net/note/delete/108886/spam Del: non-english -- https://master.php.net/note/delete/108886/non-english Del: in docs -- https://master.php.net/note/delete/108886/in+docs Del: other reasons-- https://master.php.net/note/delete/108886 Reject -- https://master.php.net/note/reject/108886 Search -- https://master.php.net/manage/user-notes.php