将文件名作为post变量是不是很糟糕？

Question

I don't know if there is a way for someone to potentially abuse this. What is a workaround? I do not want someone to be able to abuse my server by downloading content this way.

There is an option to re-email a shipping label. I basically have it setup so there is no database work besides the preparation of the page. The only other method I can think of is to have the post variable the ID of the row and then pull the file name from there.

So, is it unsafe to have a filename as a post variable (that could potentially be tampered with)?

Answer 1

It's only unsafe if you're going to do something like readfile() or include() on it.

Using the row ID would be better, but even with this you still need to consider if the user should be allowed to access the file (to avoid random id=1 id=2 id=3 testing).