File path as PHP URL parameter

Question

I have a PHP file that will be accepting several URL parameters, one of which is a local file path (c:\users\etc..). Whenever this parameter is read in, PHP makes it into double backslashes (c:\users\etc..) which my upload code will not accept as a valid path. What can I do here?

Thanks

-Jesse

At which point does it make them into double backslashes and at which point is the data rejected? Please show some code — Pekka
– Pekka, Commented Jun 15, 2011 at 13:21
I guess this is just basic escaping of characters caused by addslashes() or mysql_real_escape_string() functions (or any similar). Try stripslashes() and see if they are being removed. — Joshua - Pendo
– Joshua - Pendo, Commented Jun 15, 2011 at 13:22

Community · Accepted Answer · 2020-06-20 09:12:55Z

2

First of all, avoid accepting paths in query string for security reasons. You may want to set include path in php.ini file instead.

You can replace double backslashes with single ones like this:

$myvalue = str_replace('\\\\', '\\', $original_path);

You specify \ twice to actually escape it while replacing.

Working Example

edited Jun 20, 2020 at 9:12

CommunityBot

11 silver badge

answered Jun 15, 2011 at 13:23

Sarfraz

384k81 gold badges561 silver badges613 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

jomille Over a year ago

Yea, I tried doing this. But as you see, this statement is not properly escaped and is therefor not a valid statement. Check out the code highlighting on the code you posted.

Sarfraz Over a year ago

@jomille: Fixed that before seeing your comment :)

Carlos Campderrós Over a year ago

as the file path is passed via URL ($_GET), the f*cking gpc_quotes are involved. @jomille, check the output of var_dump(get_magic_quotes_gpc()). If it's 1, then you should stripslashes() on anything that comes via $_GET, $_POST, $_COOKIE or $_REQUEST. If it's 0, then it's totally another issue so discard my comment.

Saxoier · Accepted Answer · 2011-06-15 13:36:47Z

1

This sounds like a typical Magic Quotes-problem. You can disable them in different ways. As of PHP 5.3 they are deprecated und will be removed in PHP 6.

answered Jun 15, 2011 at 13:36

Saxoier

1,2871 gold badge8 silver badges8 bronze badges

Comments

ArtoAle · Accepted Answer · 2011-06-15 13:52:05Z

1

you can do

$newpath = str_replace("\\\\","\\",$oldpath);

or similary

$newpath = stripslashes($olpath);

note that the second one works depending on the magin_quotes setting in your php.ini

edited Jun 15, 2011 at 13:52

answered Jun 15, 2011 at 13:22

ArtoAle

2,9872 gold badges27 silver badges50 bronze badges

Collectives™ on Stack Overflow

File path as PHP URL parameter

3 Answers 3

Working Example

3 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related