RE: [PHP-DB] file upload security issue
| From: | Jennifer Goodie | Date: | Fri, 08 Aug 2003 18:43:11 +0000 |
| Subject: | RE: [PHP-DB] file upload security issue | ||
| References: | 1 | Groups: | php.db |
| Request: | Send a blank email to php-db+get-29777@lists.php.net to get a copy of this message | ||
> I try to learn file uploading in PHP. I've successfully uploaded a file
> onto my server. I use move_uploaded_file("tmp_dir/tmp_filename",
> "destination_dir/filename") to move the temp file. The thing is that I
> have to do a "chmod 777 destination_dir" in order to move the file. Is
> this bad for security?
Yes, it is.
chown the directory to the user or group that mysql runs under, then it only
needs to be owner or group writable