在这篇文章的指导下,防止PHP中的目录遍历但允许路径我试图阻止目录遍历,但我遇到了一些奇怪的事情,在第一个例子中,realpath返回了一个好的路径
$fPath = $path.$parent.'/'.$name;
//$name (the user input) in this sample is "fff", $parent is an empty string
//make sure user didn't try to traverse backwards on the basepath
$basepath = $path;
$realBase = realpath($basepath);
echo $realBase."<br/>";
//gives: /Users/me/Documents/www/gallery/php_sample/uploadedImages
$userpath = $fPath;
echo $userpath."<br/>";
//gives: /Users/me/Documents/www/gallery/php_sample/uploadedImages/fff
$realUserPath = realpath($userpath);
echo $realUserPath."<br/>";
//gives blank (an empty string).
为什么?
就像AbraCadaver在评论中所说的,"只有当目录存在时,这才有效。要验证/消毒用户提供的目录,您需要一些规则,并对其进行清理或拒绝。"