Re: Upload file - $HTTP_POST_FILES empty (thinking in harakiri)
| From: | Robert James Kaes | Date: | Fri, 23 Aug 2002 20:21:15 +0000 |
| Subject: | Re: Upload file - $HTTP_POST_FILES empty (thinking in harakiri) | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-113851@lists.php.net to get a copy of this message | ||
On Fri, 23 Aug 2002, Juan Pablo Aqueveque wrote:
> <?php
> // In PHP earlier then 4.1.0, $HTTP_POST_FILES should be used instead of
> $_FILES.
> if (is_uploaded_file($_FILES['userfile']['tmp_name'])) {
> copy($_FILES['userfile']['tmp_name'],
> "/home/juque/public_html/VI_eaf/upload/");
> } else {
> echo "Possible file upload attack. Filename: " .
> $_FILES['userfile']['name'];
> }
> /* ...or... */
> move_uploaded_file($_FILES['userfile']['tmp_name'],
> "/home/juque/public_html/VI_eaf/upload/");
> ?>
I can't be certain, but one bug I think I see is the second argument to
both copy() and move_uploaded_file() is not a complete path to a file.
You provided the path, but not the file name the uploaded file should
be saved as. So, I would change the code to be something like:
if (is_uploaded_file($_FILES['userfile']['tmp_name'])) {
copy($_FILES['userfile']['tmp_name']),
"/home/juque/public_html/VI_eaf/upload/" .
$_FILES['userfile']['name']);
} else {
echo "Possible file upload attack.";
}
I hope this helps.
-- Robert
--
------------------------------------------------------------------
Robert James Kaes --- Flarenet Inc. --- (519) 426-3782
http://www.flarenet.com/
* Putting the Service Back in Internet Service Provider *
------------------------------------------------------------------