directory traversal lockdown

[Tommahawk]

Need help in finding any good resources in locking down directory traversal.

ex. I want to discard any URL that has ../ in it.

Any ideas appreciated. Thanks...

[Frederick]

My question is why?

[Tommahawk]

so root is /myroot and does not become /root due to ?=../root

[Frederick]

?

[bradgrafelman]

I understand what he's saying. I implemented the same kind of check in my downloads script, so people couldn't escape out of the 'downloads' directory and into my root.

Try looking at [man]dirname/man and [man]realpath/man

EDIT: Also, look into using Safe Mode with open_basedir restrictions.