In our app (PHP, MySQL) we allow users to create templates which are stored in their own subdirectory (which is named by the template name).

Someone suggested to use standard file name sanitization but I am not too comfortable to allow user to name their template 'mytemplate.php'

IS allowing extensions on directory names a security risk?

  • What OS are you using?
    – Mark
    May 27, 2014 at 1:38
  • I'm not sure I quite understand the question - it looks like you're asking about directory names, but then you mention naming a file with a ".php" extension. Directories named like "something.php" aren't bad, but don't allow users to define actual files with ".php" extensions on them...that's just asking for trouble. If you're going to allow users to define the name of the file for the template, I wouldn't use that directly as a file name. You could also potentially open yourself up to directory traversal or a RFI if you're not careful.
    – enygma
    May 27, 2014 at 11:31

2 Answers 2


Well, renaming only the folder is more a matter of good practice. In the case you want the user to access his template folder like: site.com/templates/mytemplate.php; I would recommend you implement "Friendly URL" (Semantic URL), so in this case you would pass the 'mytemplate.php' like a variable and not like a folder name.


If it is, because of the dot character, you can get away with encoding that character somehow, e.g. urlencoding. The one other character you would need to encode anyway, because it's not allowed in directory names, is the slash. And, if it's urlencoding, don't forget the percent sign itself.


  1. %%25
  2. .%2E
  3. /%2F

Escape sequences:

  1. \\\
  2. .\.
  3. %\%

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .