note 53668 added to function.realpath

This function is also nice to test for security-breaches. You can forbid the script to access files below a certain directory to prevent "../../../etc/shadow" and similar attacks: <?php // declare the basic directory for security reasons // Please do NOT attach a "/"-suffix ! $basedir = '/var/www/cgi-bin/scriptfolder'; // compare the entered path with the basedir $path_parts = pathinfo($_REQUEST['file_to_get']); if (realpath($path_parts['dirname']) != $basedir) { /* appropriate action against crack-attempt*/ die ('coding good - h4x1ng bad!'); } ?> The url "script.php?file_to_get=../../../etc/shadow" will now result in an error. ---- Manual Page -- http://www.php.net/manual/en/function.realpath.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+53668 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+53668&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+53668&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+53668&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+53668&report=yes&reason=useless Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+53668&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+53668&report=yes Search -- http://master.php.net/manage/user-notes.php