Q:

Problem with $_GET and fopen

I have a weird problem with $_GET method. I have a php code like this:
$fopen("files/" . $_GET['file'], "r");

When i write file path parameter my self It's run good but when I get the file name from $_GET method it shows me some error like the path is wrong.

What's wrong with it ? 
Is there any special encoding for $_GET method to decode it to the right string        style. I tried urldecode but it wasn't make any change.

A:

Number one rule is to sanitize your input.  Using $_GET like that is just asking for trouble.
Do the right thing.  Put the $_GET value into a variable, verify that it is valid input THEN try to open the file.

A:

Don't EVER use user input without validation, especially not for opening files on the host computer!  I cannot overstate just how dangerous this is.  What if someone entered a GET string with the value '../../../../../etc/password' into your application?  

