Preventing users from abusing an image deletion script
<p>Basically the following for the core part:</p>

<pre><code>$file = basename($_GET['f']);
$directory = "/var/www/site/";
$file = $directory . $file;
$hash = $_GET['h'];
$md5check = md5($file);
$md5check = substr($md5check, 0, 5);

if ($md5check == $hash) {
    if (file_exists($file)) {
        unlink($file);
    }
    else {
        die('error');
    }
}
else {
    header('Location: error');
    exit;
}
</code></pre>

<p>I realise using the users input is asking for trouble, but how can I get the server to 'locate' the file to delete? Am I somehow able to escape injections?<br />
The user would be loading <a href="http://site.com/?f=test.jpg&amp;h=hashc" rel="nofollow">http://site.com/?f=test.jpg&amp;h=hashc</a></p>

<p>Also is there any other hash systems besides MD5 which is separate for each location of a file? <br />
eg. <br /> 
file1.rar downloaded at 12:00am = differenthash <br />
    file1.rar downloaded at 11:00pm = randomhash<br />
file1.rar is the same file in both scenarios. </p>

<p>versus md5:<br />
file1.rar downloaded at 12:00am = randomhash <br />
    file1.rar downloaded at 11:00pm = randomhash<br />
file1.rar is the same file in both scenarios. </p>
