Question

So i’m getting into security problems right now, and i want to know what is the perfect approach in making scripts safe. I have somewhere in my code this

$AdditionalPath = preg_replace("/^[A-Za-z0-9._-\/\\]/","",$AdditionalPath);
require $AdditionalPath."../xdata/php/website_config/mysql.php";

$AdditionalPath may be everything, even a malicious code, so i tough to myself that i should let certain characters into that variable, like A-Z a-z 0-9 . / \ . I’m i correct? And also did i made this regex correctly?

Thanks!

Answer 1

Why not use realpath instead of a regex:

$file = realpath( $AdditionalPath . "../xdata/php/website_config/mysql.php");
if( is_readable( $file ))
  require $file;

Update:

From the documentation of realpath:

Note: The running script must have executable permissions on all
directories in the hierarchy, otherwise realpath() will return FALSE.