JustinsLorel

So from what i understand i should hard code part of the Url into my php form limiting the user to that scope. Would it make sense to have an if statement ignore '..' and '...' input?

Hey guys, i have created a php file which takes two parameters: a subdirectory path a file extension it then echos the complete path pf (glob()) all the files with that extension in the searching folder. I wanted to know the security issues involved with this and how i might use escape methods to make sure someone can't move up the directory listing and get other filename. Are there any other concerns i should have? No data is coming or going to a database however there are other php files on the server which communicate with mySQL. Thanks alot!