I have a script that have this code:

$name = preg_replace('/[^a-z0-9_.]/', '', $_GET['name']);

$_GET['name'] = ../../conf.php but preg_replace filtered my slash (/) and $name will be ....conf.php Can I bypass it ?

1 Answer 1


Likely not. That is a whitelist regex (the ^ is a not) which replaces anything that isn't literally a-z or 0-9 or underscore or period with nothing - it removes it.

That is actually the recommended way to do that if you can - by being so restrictive on what is allowed, they eliminate control characters, slashes, escaping (% or &), everything that might break it.

Best you can do that I can see is '..', which might cause it to open the parent directory and provide some info for you, but probably not.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .