PHP Tutorials: Security - File Uploading

Not protecting file uploads is a common security problem, and can lead to a variety of security issues. Have you protected your file upload process?

WEBSITE
http://phpacademy.org

FORUM
http://phpacademy.org/forum

TWITTER
http://twitter.com/phpacademy

FACEBOOK
http://www.facebook.com/group.php?gid=64583401868

Category:

Education

Tags:

• php
• upload
• security
• tutorial
• tutorials
• hacking
• hacker
• hack
• file
• include
• secure
• including
• files
• securely
• deface
• attack
• delete

[ncili]

i use to wonder y no one on the whole internet has done a php video upload tutorial until i decided to try it myself and i can tell u all its because of the video player. i know u all like me have searched youtube and google for php video upload tutorial and its not there, ive been searching for years. i have emailed everyone on here who do these tutorials and have gotten no response. adding the video player and having it call the video to play is difficult and cant be done locally.

[MrTechnikfan100]

Thank you very much

[pestinha26]

hi adam,

i been following your videos for a while now and i wanted to ask you about file upload with jquery.

I have a form with text and file inputs. the validation is made through jQuery and everything works fine, except for the files. i cant seem to pass the file to php script.

help?

thank you =)

[ca2mca2m]

we can explode the file name using "explode" function to see how many . in the file name and we can get the file extension from the result of explode function using "array_pop" function look how its work

$ext = array_pop(explode(".", $_FILES["uploade"]["name"])); // if file's name is "Islam.gif" the result is "gif"

[Spelter]

aaah, damn youtube :) i lost my newlines ;)

so, basicly, you upload the file in an temp-folder, determine the mime-type, and if its not image/gif or image/jpg, delete it and stop the process with die("error in file"). Search for "php function mime-content-type" and you get the Manualpage from php net

[Spelter]

Hi, its not true that the server wont execute an image or serves it. It is your browser which makes the error. To ensure that you just getting images, you should: 1) avoid external Loading via ht*p oder f*p 2) ensure that the mime-type is allowed. from php net echo "php.gif " . mime_content_type('php.gif') . "\n"; echo "test.php " . mime_content_type('test.php'); it echos php.gif image/gif test.php text/plain ....

[mipfer]

you can try phpinfo.php.jpg

ive tried that on some websites and it worked!

it executes it as PHP..

[daeheadshot]

@altu892 Linux FOR THE WIN!

[altu892]

Linux!!!!!!

[wideload123]

@RawRzCopteR More or less the same, I generally alternate between using these two methods.