Home/ Questions/Q 8661421
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-12T16:29:38+00:00

I don’t know if there is a way for someone to potentially abuse this.

  • 0

I don’t know if there is a way for someone to potentially abuse this. What is a workaround? I do not want someone to be able to abuse my server by downloading content this way.

There is an option to re-email a shipping label. I basically have it setup so there is no database work besides the preparation of the page. The only other method I can think of is to have the post variable the ID of the row and then pull the file name from there.

So, is it unsafe to have a filename as a post variable (that could potentially be tampered with)?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    It’s only unsafe if you’re going to do something like readfile() or include() on it.

    Using the row ID would be better, but even with this you still need to consider if the user should be allowed to access the file (to avoid random id=1 id=2 id=3 testing).

    • 0