What are the potential security risks of allowing PHP scripts to delete files outside of the web root directory?

Allowing PHP scripts to delete files outside of the web root directory can pose a significant security risk as it can potentially delete important system files or sensitive data. To mitigate this risk, it is important to restrict file deletion to only within the web root directory to prevent unauthorized access to critical files. 

<?php
$directory = '/path/to/web/root/';
$fileToDelete = $directory . 'file_to_delete.txt';

if (strpos(realpath($fileToDelete), $directory) !== 0) {
    die("Access denied.");
}

if (file_exists($fileToDelete)) {
    unlink($fileToDelete);
    echo "File deleted successfully.";
} else {
    echo "File does not exist.";
}
?>

Keywords

PHP security risks file deletion web root directory vulnerability

Related Questions