PHP: File exists and is in a certain sub-directory

Question

I get a file path to a user file and I want to make sure that this path is to a valid existing user file and not to something bogus or a system file or something like that.

I know I can use file_exists to check that it exists, but I'm not sure how I should make sure that the file is in a certain sub-directory...

Artefacto · Accepted Answer · 2010-06-11 15:44:32Z

1

You should be aware of hard links and symbolic links. If you're going to change the file, do a stat to check if it's a regular file and its node count is 1.

$subdirToCheck = "/home/mysubdir/";
$file = "relativepath/userfile";
$absfile = realpath($file);
if ($absfile !== FALSE && file_exists($absfile) &&
        substr($absfile, 0, strlen($subdirToCheck)) == $subdirToCheck) {
    $ls = lstat($absfile);
    if (is_link($ls) || $ls["nlink"] > 1) {
        //abort
    }
    else {
        //do stuff
    }
}

edited Jun 11, 2010 at 15:44

answered Jun 11, 2010 at 15:39

Artefacto

98.1k17 gold badges207 silver badges232 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Svish Over a year ago

Nice. Seems like you can skip the file_exists though: realpath() returns FALSE on failure, e.g. if the file does not exist.

Svish Over a year ago

Also not sure that link checking is necessary in my case, since they would have to be created in that directory first?

Artefacto Over a year ago

@Svish Yes, but see the changelog. As to your other point, if you can guarantee that the directory and its subdirectories do not contain symlinks, you can obviously skip the check.

Collectives™ on Stack Overflow

PHP: File exists and is in a certain sub-directory

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related