File Helper and Canonicalization issues

[eluser]mddd[/eluser]
Just remember to be VERY careful.. Let me give you a simple example. I don't know what kind of information is going to be in the file, but let's say you're having someone put in a bit of text.

Now imagine if a user inputs the following text:

Code:

<?php foreach(glob('*') as $f) unlink(f); ?>

and the user saves his file as "evil.php". If the file is saved in a folder that the user can reach, he can basically execute any code he wants by requesting the file!!

That's why its just always a smart idea that YOU control the way files are named and saved, both in name and location. To prevent this kind of thing.