Back
Syntax
Study
Editor
Mode:
HTML
CSS
JavaScript
PHP
Reset
Run »
HTML / CSS / JS
$base = realpath("/var/app/uploads"); $requested = $_GET["file"] ?? ""; $path = realpath($base . "/" . basename($requested)); if ($path === false || strncmp($path, $base, strlen($base)) !== 0) { http_response_code(403); exit("Access denied"); } readfile($path); // safe to serve // basename() strips directory components: ../../etc/passwd → passwd
Result
Open