In our app (PHP, MySQL) we allow users to create templates which are stored in their own subdirectory (which is named by the template name).

Someone suggested to use standard file name sanitization but I am not too comfortable to allow user to name their template 'mytemplate.php'

IS allowing extensions on directory names a security risk?

  • What OS are you using? – Mark May 27 '14 at 1:38
  • I'm not sure I quite understand the question - it looks like you're asking about directory names, but then you mention naming a file with a ".php" extension. Directories named like "something.php" aren't bad, but don't allow users to define actual files with ".php" extensions on them...that's just asking for trouble. If you're going to allow users to define the name of the file for the template, I wouldn't use that directly as a file name. You could also potentially open yourself up to directory traversal or a RFI if you're not careful. – enygma May 27 '14 at 11:31

Well, renaming only the folder is more a matter of good practice. In the case you want the user to access his template folder like: site.com/templates/mytemplate.php; I would recommend you implement "Friendly URL" (Semantic URL), so in this case you would pass the 'mytemplate.php' like a variable and not like a folder name.

| improve this answer | |

If it is, because of the dot character, you can get away with encoding that character somehow, e.g. urlencoding. The one other character you would need to encode anyway, because it's not allowed in directory names, is the slash. And, if it's urlencoding, don't forget the percent sign itself.


  1. %%25
  2. .%2E
  3. /%2F

Escape sequences:

  1. \\\
  2. .\.
  3. %\%
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.