Are there any potential security risks associated with the file handling in the PHP code provided?

The provided PHP code is vulnerable to directory traversal attacks, as it directly concatenates user input ($_GET['file']) with the file path without proper validation. To mitigate this security risk, it is essential to sanitize and validate the user input before using it to access files on the server. 

<?php
// Sanitize and validate the user input
$file = isset($_GET['file']) ? basename($_GET['file']) : 'default-file.txt';
$filepath = 'uploads/' . $file;

// Check if the file exists before accessing it
if (file_exists($filepath)) {
    // Process the file
    $fileContent = file_get_contents($filepath);
    echo $fileContent;
} else {
    echo 'File not found';
}
?>

Keywords

file handling security risks PHP code vulnerabilities error handling

Related Questions