note 48064 added to security.filesystem

What about: <?php $file_to_delete = '/home/'.$username.'/'.$userfile; if ((!ereg('\.\.', $file_to_delete)) and (file_exists($file_to_delete))) { unlink($file_to_delete); } ?> I think this should prevent every attempt to go outside the user-directory. Additionally you should check usernames at the registration. Another way whould be to use the user-ID as home-directory - so, this can't be changed and every registered user as an unique one (if it's a primary key in your database). But then you still have to check the given $userfile. So the code above could be taken as a "last instance check" directly before finally deleting of the file. ---- Manual Page -- http://www.php.net/manual/en/security.filesystem.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+48064 Delete -- http://master.php.net/manage/user-notes.php?action=delete+48064&report=yes Reason: bad code -- http://master.php.net/manage/user-notes.php?action=delete+48064&report=yes&reason=bad+code Reason: spam -- http://master.php.net/manage/user-notes.php?action=delete+48064&report=yes&reason=spam Reason: useless example -- http://master.php.net/manage/user-notes.php?action=delete+48064&report=yes&reason=useless+example Reason: contains commercial links -- http://master.php.net/manage/user-notes.php?action=delete+48064&report=yes&reason=contains+commercial+links Reason: useless note -- http://master.php.net/manage/user-notes.php?action=delete+48064&report=yes&reason=useless+note Reject -- http://master.php.net/manage/user-notes.php?action=reject+48064&report=yes Search -- http://master.php.net/manage/user-notes.php