What potential issues can arise when accessing PHP files with appended "/xxxx" in the URL?

Accessing PHP files with an appended "/xxxx" in the URL can potentially expose sensitive information or allow unauthorized access to files on the server. To prevent this, you can use PHP to check if the requested file exists before including it. If the file does not exist, you can redirect the user to a 404 page or display an error message. 

<?php
$requested_file = $_SERVER['DOCUMENT_ROOT'] . $_SERVER['REQUEST_URI'];

if (file_exists($requested_file)) {
    include $requested_file;
} else {
    header("HTTP/1.0 404 Not Found");
    include '404.php';
}
?>

Keywords

security URL manipulation directory traversal file inclusion vulnerability

Related Questions