PHP unlinking not working with variable

Question

Going out of my mind with php unlinking

Here is my delete file script

$pictures = $_POST['data'];
//print_r ($pictures);
$imageone = $pictures[0];




    $filename = "file:///Users/LUJO/Documents/CODE/REVLIVEGIT/wp-content/uploads/dropzone/" . $imageone;



    echo $filename;

if (is_file($filename)) {

   chmod($filename, 0777);

   if (unlink($filename)) {
      echo 'File deleted';
   } else {
      echo 'Cannot remove that file';
   }

} else {
  echo 'File does not exist';
}

The above does not work, error response is file does not exist

however if i change the filename path to this (the echo data from the echo above)

$filename = "file:///Users/LUJO/Documents/CODE/REVLIVEGIT/wp-content/uploads/dropzone/1420291529-whitetphoto.jpeg "

works fine and deletes the image.

Why can i not use the $imageone variable?

Answer 1

Do a print_r($pictures) to see if $pictures[0] is indeed the filename you're looking for.

Also note that if $pictures[0] is "//windows/*" you'll loose your windows if the user running PHP has administrative rights... so just using $pictures=$_POST["data"] is very VERY unsafe!