header("Content-type: text/css; charset: UTF-8"); $var = $_GET['var']; $var = str_replace(array('/', '../'), array('', ''), $var); echo file_get_contents($var);
Is it possible to exploit Path Traversal without using forward slash?
In other words, would this code be enough to prevent Path Traversal?
$var = str_replace(array('/', '../'), array('', ''), $var);
- What about backward slash? is it safe?
- Would double encoding and hex encoding have any affect on that?
- How would you rate it impact?
- What is your suggestion for a better solution?
PS: Operation System: Linux