Re: Uploading Files

Hi, I have the similar function for my client for uploading. But I only let them upload gif or jpeg files format. Using the following command, I think it would be pretty safe. if ($pic_type!="image/jpeg") { not allow to upload } else { allow} Can this be prevented from uploading executable file ?? Thank you Mark ----- Original Message ----- From: Tom Walsh <TWalsh@achieversusa.com> To: 'Adam Plocher' <aplocher@erepublic.com>; <php-general@lists.php.net> Sent: Thursday, September 28, 2000 2:58 AM Subject: RE: [PHP] Uploading Files > There sure are... Anytime you are uploading files from an end user you can > have all sorts of problems. One that typically happens because alot of > people do not think this through is... Taking a graphic file (or what they > assume to be a graphic file) and placing it in the web structure. > > Case in point: An associate of mine is running a server with just such a > feature in PHP. I took it upon myself to create a PHP script and uploaded it > to the server. Then pointed my browser to it and it excuted (due to the fact > he had no mime checking or rename feature on the files that were uploaded). > When I pointed my browser to it, it went out and grabbed his passwd file and > mailed a copy to him. > > He fixed the hole in under 10 minutes. :-) > > Use caution young Jedi. > > Tom Walsh > http://www.designgeek.com > > > -----Original Message----- > > From: Adam Plocher [mailto:aplocher@erepublic.com] > > Sent: Wednesday, September 27, 2000 12:59 PM > > To: 'php-general@lists.php.net' > > Subject: [PHP] Uploading Files > > > > > > Are there any security risks involved when allowing people to > > upload a file > > over the web with PHP? > > > > Thanks, > > Adam Plocher > > > > -- > PHP General Mailing List (http://www.php.net/) > To unsubscribe, e-mail: php-general-unsubscribe@lists.php.net > For additional commands, e-mail: php-general-help@lists.php.net > To contact the list administrators, e-mail: php-list-admin@lists.php.net >