Re: Strategy for Secure File Storage
| From: | Colin Guthrie | Date: | Tue, 25 Sep 2007 21:26:38 +0000 |
| Subject: | Re: Strategy for Secure File Storage | ||
| References: | 1 2 3 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-262466@lists.php.net to get a copy of this message | ||
Kevin Murphy wrote:
> $ext = explode(".",$file);
>
> $extension = $mimetypes["$ext[1]"];
Other people have provided answers so I'll just make a quick comment on
this bit.
It's not ideal but if you only upload a subset of file types then I
guess it's OK.
Also if the file has more than a single "dot" in it (e.g. my.image.jpg)
which is perfectly valid, then $ext[1] will contain ("image") which
isn't right.
If possible use e.g.
http://www.php.net/manual/en/function.mime-content-type.php
or Example
606 here http://www.php.net/manual/en/function.finfo-file.php
but these
may not be available on your PHP install.
You should probably check more thoroughly:
e.g.
$mimetype = 'application/octet-stream'; // default
$ext = array_pop($dummy = explode('.', $file));
if (!empty($mimetypes[$ext]))
$mimetype = $mimetypes[$ext];
or something similar.... (not tested above!)
Hope this helps ya.
Col