note 31182 added to security.filesystem

A way to validate if a requested directory or file (passed by argument or what-have-you) is in your doc root tree: $t = apache_lookup_uri($dir); if ( (!file_exists($t->filename)) || (is_null($dir)) ) { echo "NOT VALID!"; } else { echo "VALID -- " . $t->filename; } This prevents the user from passing in an empty dir (simply remove the is_null() to eliminate this feature). Further security is up to the programmer (At least this way you can throw out a chunk of ../../../../../etc/passwd). -- http://www.php.net/manual/en/security.filesystem.php http://master.php.net/manage/user-notes.php?action=edit+31182 http://master.php.net/manage/user-notes.php?action=delete+31182 http://master.php.net/manage/user-notes.php?action=reject+31182