What potential security risks are associated with using the unlink() function in PHP to delete files?

Using the unlink() function in PHP to delete files can pose a security risk if user input is not properly sanitized. This can lead to directory traversal attacks where an attacker can delete files outside the intended directory. To mitigate this risk, it is important to validate and sanitize user input before passing it to the unlink() function. 

$file = 'uploads/' . basename($_GET['file']);

if (strpos($file, 'uploads/') === 0 && file_exists($file)) {
    unlink($file);
    echo 'File deleted successfully.';
} else {
    echo 'Invalid file path.';
}

Keywords

unlink() PHP security risks file deletion vulnerabilities

Related Questions