note 108886 modified in security.filesystem by danbrown

you should check requested file name for back path.a person can delete your code file by going back to root directory.

for ex:- deletefile.php?file=../index.php

if no proper check for / or \\ any user can delete your index page or any usefull file.

you may use following function to check for back path.

<?php
function existBackPath($file){ 
	$file=str_replace("\\\\","/",$file);
 return preg_match('[\\/]', $file);
}
?>

if existBackPath function returns 1.It means someone is trying to delete file which does not exist in his/her directory rather it exist in your root directory. --was-- you should check requested file name for back path.a person can delete your code file by going back to root directory. for ex:- deletefile.php?file=../index.php if no proper check for / or \ any user can delete your index page or any usefull file. you may use following function to check for back path. function existBackPath($file){ $file=str_replace("\\","/",$file); return preg_match('[\/]', $file); } if existBackPath function returns 1.It means someone is trying to delete file which does not exist in his/her directory rather it exist in your root directory. http://php.net/manual/en/security.filesystem.php