php realpath()返回一个空字符串
问题描述:
Guided by this post Preventing Directory Traversal in PHP but allowing paths I am trying to prevent directory traversal, but I am experiencing something odd, in the first instance realpath returns a good path
$fPath = $path.$parent.'/'.$name;
//$name (the user input) in this sample is "fff", $parent is an empty string
//make sure user didn't try to traverse backwards on the basepath
$basepath = $path;
$realBase = realpath($basepath);
echo $realBase."<br/>";
//gives: /Users/me/Documents/www/gallery/php_sample/uploadedImages
$userpath = $fPath;
echo $userpath."<br/>";
//gives: /Users/me/Documents/www/gallery/php_sample/uploadedImages/fff
$realUserPath = realpath($userpath);
echo $realUserPath."<br/>";
//gives blank (an empty string).
Any idéas on why?
答
Like AbraCadaver said in comment, "This only works if the dir exists. To validate/sanitize the user supplied dir you will need some rules and clean it or reject it."