What potential pitfalls should be avoided when specifying file paths in PHP scripts?

When specifying file paths in PHP scripts, it's important to avoid hardcoding absolute paths as they can be different on different servers. Instead, use relative paths to ensure portability. Additionally, be cautious of using user input directly in file paths to prevent security vulnerabilities like directory traversal attacks. 

// Bad practice: Hardcoding absolute file path
$file = '/var/www/html/myfile.txt';

// Better practice: Using relative file path
$file = 'myfile.txt';

// Avoid using user input directly in file paths
$userInput = $_GET['file'];
$directory = '/var/www/html/';
$file = $directory . $userInput;

Keywords

file paths PHP scripts include_once realpath directory traversal

Related Questions