PHP Security Advice on $_GET (combining clean URLs with query string)

Question

I am using "clean" URLs like this:

http://localhost/controller/action/param

I access the parameters with a custom function like this my_get(1), my_get(2), etc...

However there are times where I think I need to combine them with query strings. For example: If I need parameter values containing paths with several slashes like:

http://localhost/controller/action/param?mypath=foo/bar/qux.jpg

I do that because it would be a little harder to implement if done with clean URL.

Now my question is, in combining clean URL and with query string, I only intend to allow this character class:

[.&=a-z0-9\/_-]

I was wondering would there be any security issue with it? Should I disallow certain characters?

Answer 1

Don't mind about string formatting, but please validate the path passed... In the example you said: " in the example above, mypath's value will be deleted with unlink();", well, if you don't validate it in worst cases an attacker could delete any file on the filesystem of the server... ;)

So don't bother about validating the string with a regex, but validate the content of the string and make it safe for your environment... :)