Re: is_uploaded_file() security

hi, I think marek's recent message has answered this already, but i also believe that even in the older system where you have form fields like <input type="file" name="userfile"> result in global variables like userfile_name etc the global variables don't get populated unless you send the correct enctype. best regards Alexander Mueller wrote:

Raditha Dissanayake wrote:

Hi, Multipart/form-data sends the entire file, if you don't use that enctype yes, just the file name is sent. best regards

I see, but then $_FILES is probably not set. So it wouldnt be necessary to use is_uploaded_file() if one solely uses $_FILES (but should probably nevertheless for any possible bugs - as Marek mentioned). Did I miss anything? Alexander

-- Raditha Dissanayake. ------------------------------------------------------------------------ http://www.radinks.com/sftp/ | http://www.raditha/megaupload/ Lean and mean Secure FTP applet with | Mega Upload - PHP file uploader Graphical User Inteface. Just 150 KB | with progress bar.