Defeating Path Traversal Attacks

Imagine you have an app which takes some user input which ends up in a path: $userProvidedData = $_GET [ 'fileName' ]; $path = '/path/to/safe/directory/' . $userProvidedData ; This is no good, if the user sends the value ../../../../etc/passwd then the $path becomes /path/to/safe/directory/../../../../etc/passwd aka /etc/passwd . This is a classic path traversal attack. It's very simple to defeat:…