title: Ajax Security Question: JQuery ajax() + PHP scandir() = Security Issue?
body: <p>I'm a beginner with PHP security issues. Someone reported a security issue with my code, but never gave details. </p>
  
  <p>Below is a condensed version of the code. I'm using the JQuery AJAX function to send some data to the server where it's used by the PHP scandir() function.</p>
  
  <p>Do you see any security issues?</p>
  
  <p>HTML Document</p>
  
  <pre><code> &lt;script 
     src="http://ajax.googleapis.com/ajax/libs/jquery/1.3.2/jquery.min.js"&gt;
   &lt;/script&gt;
   &lt;script&gt;
  $.ajax({
      type: "POST",
      url: "example.php",
      cache: false,
      data: {
          foo: "images",
          bar: "something else",
              },
      success: function(html){
      alert(html);
      }
  });
  &lt;/script&gt;
  </code></pre>
  
  <p>PHP Document</p>
  
  <pre><code>&lt;?php
  
  $foo = filter_var($_POST["foo"], FILTER_SANITIZE_STRING);
  $bar = filter_var($_POST["bar"], FILTER_SANITIZE_STRING);
  
  $foo = scandir($foo);
  $bar = (explode(",",$bar));
  
  foreach ($foo as $a) {
      echo "&lt;img src='$foo/$a'&gt;";
  }
  
  ?&gt;
  </code></pre>