Checking a string to see if file exists locally

Question

I have a question if I may. I have a variable named `$source` and this should contain a relative path to a file, for example `./uploads/2012/some-document.pdf` Now, this `$source` variable will contain user input, via $_GET and $_POST. I don't want people to enter URLs and I only want to do something if the file exists only on the local server. My question is what is the best way to check if a file exists on the local server only? This is what I've got so far: 1) `file_exists` may return true depending on the server configuration, so I could use this alongside stripos to check if the first few charatcers of the string is http:// like so: ``` if( file_exists($source) && stripos($source,'http://')!==0 ) { echo 'File exists on local'; } ``` However, the downside would be I'd have to specify all the different URL types such as https://, http:// and ftp:// just to be safe. 2) I use `realpath` to get the absolute path of the file, and this returns false if it cannot be found. This seems to…

Accepted Answer

In addition to the other answers, you can deny paths that use a scheme simply with:

```
if (parse_url($path, PHP_URL_SCHEME)) {
    // has something:// so ignore
}
```

This would also work with specialty wrappers such as `php://`, `zlib://`, etc...

You can also force a local check on the input variable by prepending with `file://`:

```
file_exists('file://' . $path);
```

Checking a string to see if file exists locally

Solution

Problem