In the operation of a web resource, it is convenient to use temporary files to store data during processing. Once the work is completed, there is no need to store such files. The site may provide the visitor with the ability to download files. The data may be uploaded by mistake or sent and deleted from the hosting after uploading. In these and many other cases, PHP offers the unlink() function to remove information from the file system provided by the host for the web resource.
Hosting terms and filenames
Creating a hosted file may execute PHP code due to the need for permanent or temporary data storage. Files can be downloaded through the pages of the site. In any case, the name of the file and the path to it matter.
As a rule, data is placed in specially allocated folders and cannot be placed at the site code location. Before deleting a file, it must be checked what exactly will be deleted.
Hostings, as usual, are Apache or Windows servers. For safe and stable operation of a web resource, it is advisable not only to control, but also to form the name of each file. Trust the visitor to download files with arbitrarynames are not allowed.
To preserve the original name, you can create a special name matching table. Each uploaded file gets a new name, but the exact original name is kept. When creating a file, the site "chooses" the name of the file. Under these conditions, using PHP's unlink() function is safe and secure.
Delete file
The file system provided to the web resource starts at position $_SERVER['DOCUMENT_ROOT']. Each folder, starting from the root of the site, has its own access rights. It is not customary to install blocking and protection that harm the site.
If any operation is prohibited, it will simply not be executed. The site has worked and will continue to work.
It is not necessary to check the actual existence of the file before executing the PHP unlink() function. If something is wrong, an E_WARNING level error is generated. By escaping the function call with the "@" symbol, you can ignore this error. If you want to write professional code, you should check the path, file name and its actual presence before deleting.
Situations where PHP's unlink function doesn't work are hard to imagine. The only important thing to consider is the extremely close attitude of any hosting to the case of letters and Cyrillic.
To avoid problems, both filenames and file deletion should be kept under responsible control.
