ajax - Beginner RegEx Question - PHP RegEx to allow only relative paths (not URL's) -
Do anyone know PHP Regx to allow only relative path, not at all?
For example, I have an AJAX function that submits this value to my PHP script "Some directory / other-directory / some-file.php".
In my PHP script, that file is included ... ($ some -pp-document);
I do not want a hacker to submit something like this to use my AJAX function: ""
In my PHP document, do something like this:
& lt; Php & gt; $ Some-php-document = $ _POST ["some_value_submitted_via_ajax"]; // If $ some-php-document is a URL (not a relative path to the file), // then $ some_php_document = null // How can I use php regex to above? & Lt; / Php>
How can I do this?
Or, I know that there are more secure solutions.
Let me use the function instead of a regexp, like something:
< Code> & lt; Php $ some_php_document = $ _POST ["some_value_submitted_via_ajax"]; $ Parse_doc = parse_url ($ some_php_document); // If $ some-php-document is a URL (does not have a relative path for the file), // then $ some_php_document = null if (isset ($ parseed_doc ['scheme']) | isset ($ parseed_doc ['host '])) {$ Some_php_document = null; }? & Gt;
The file path will be in $ parse_doc ['path']. It should be checked before being used, so an attacker can not say this, request / etc / passwd or some similarly sensitive file.
Comments
Post a Comment