Re: Error in php doc?

Hi. First thanks for the replies. Can anyone confirm that the php 5.2.0 engine takes the file name from the path automatically and so basename() can be omitted? I understand that leaving basename() in the code won't hurt, but I need the info for other purpose. Thanks.

Hi. There seems to be a minor error in the page http://www.php.net/manual/en/features.file-upload.php. In Example 38-2 "Validating file uploads", there is a line: $uploadfile = $uploaddir . basename($_FILES['userfile']['name']); It looks like basename() is not required there. Because i found that when i upload a file using IE6 (IE6 includes the whole path to the uploaded file, see http://jakarta.apache.org/commons/fileupload/faq.html#whole-path-from-IE), the value of $_FILES['userfile']['name'] is a file name but not a path. It looks like php has taken the file name from the path automatically. (I am using php 5.2.0 and win2k.) Can someone check if i am correct? Thanks. There are probably other reasons to keep that there... For starters, IE is not the only browser, much less the only User Agent. In particular, I would presume somebody out there has crafted an evil uploader that sends paths like, oh, "../../../../../../etc/passwd" as the 'name' of the upload. If you are silly enough to blindly use that and overwrite your passwd file, well, there ya go. The 'name' field should not be trusted. It comes from tbe user, and anybody who can count past 10 with their shoes on could spoof it to any value they like, including malicious values. Plus, unless you check every single minor release version of PHP, you can't be sure it ALWAYS stripped the path out. -- Some people have a "gift" link here. Know what I want? I want you to buy a CD from some starving artist. http://cdbaby.com/browse/from/lynch Yeah, I get a buck. So?

_________________________________________________________________ Learn English via Shopping Game, FREE! http://www.linguaphonenet.com/BannerTrack.asp?EMSCode=MSN06-03ETFJ-0211E