What are the best practices for allowing users to select the destination for exported files in PHP?

When allowing users to select the destination for exported files in PHP, it is important to validate and sanitize the user input to prevent security risks such as directory traversal attacks. One way to do this is by using PHP's realpath() function to ensure the selected destination is a valid directory path on the server. Additionally, consider restricting the allowed directories or providing a dropdown list of predefined options to prevent users from selecting sensitive system directories.

// Validate and sanitize user input for file destination
$destination = isset($_POST['destination']) ? $_POST['destination'] : '';
$destination = realpath($destination);

// Check if the destination is a valid directory path
if ($destination && is_dir($destination)) {
    // Proceed with exporting the file to the selected destination
    // Your export logic here
} else {
    // Handle invalid destination input
    echo "Invalid destination directory selected.";
}