Re: does this code look like it would check a file extensions, and disallow php files or exe files to be attached

dave peaachepea wrote:

<?php $filelinks=t3lib_div::_POST('file_name'); // the posting of the file name

$exttypes = "php3,php,exe";                                     // list of

extensions that shouldnt be used

$fileextension = substr($filelinks,0,strpos($filelinks,"."));     //get the

extension after the .

if ($fileextension == $exttypes['php']['php3']['exe']) {         //if the

file extension equals php, php3, or exe

   echo "mime type doesn't work";                                 //if the

extension is php, php3, exe, than echo doesn't work }

   if ($fileextension != $extypes['php']['php3']['exe']) {     //if the

file extension doesn't equal php, php3, or exe than

                                                               // store the

file

       $filelinks = $this->storeFile();
       }

?> I'm not a programmer, and I'm very new at php so im sure there are errors and stupid logic in my code. It would be greatly appreciated if anyone here could critique and rip apart my code. thank you, -dave

A bit easier: <?php // the posting of the file name // Not sure where your getting this from, some class? As long as it gets the filename. $filelinks = t3lib_div::_POST('file_name'); // list of extensions that shouldnt be used $exttypes = array("php3", "php", "exe"); //get the extension after the . $fileextension = substr($filelinks, strpos($filelinks, ".")+1, strlen($filelinks)); // is the extension in the list? if (in_array(strtolower($fileextension), $exttypes)) { // yes it is, so its not allowed echo "mime type doesn't work"; } else { // no its not, so the file is allowed $filelinks = $this->storeFile(); } ?>