0

I have a script that have this code:

$name = preg_replace('/[^a-z0-9_.]/', '', $_GET['name']);

$_GET['name'] = ../../conf.php but preg_replace filtered my slash (/) and $name will be ....conf.php Can I bypass it ?

2

Likely not. That is a whitelist regex (the ^ is a not) which replaces anything that isn't literally a-z or 0-9 or underscore or period with nothing - it removes it.

That is actually the recommended way to do that if you can - by being so restrictive on what is allowed, they eliminate control characters, slashes, escaping (% or &), everything that might break it.

Best you can do that I can see is '..', which might cause it to open the parent directory and provide some info for you, but probably not.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.