Metadata

ID: php-security/avoid-unlink

Language: PHP

Severity: Notice

Category: Security

CWE: 502

Description

This rule warns against unsafe calls to the unlink function, which can lead to unintended file deletions or security vulnerabilities if the input is not properly validated. Using unlink without strict controls on the input path can allow attackers to delete critical files or manipulate the file system.

It is important to ensure that any file path passed to unlink is carefully validated and restricted to a safe set of directories or filenames. This prevents accidental or malicious removal of important files. Avoid using user-supplied input directly without sanitization or explicit allowlists.

Non-Compliant Code Examples

<?
$val = $_GET["getsomevalue"];
$object = unlink($val);
?>

Compliant Code Examples

<?
$object = unlink('myfile.php');
?>