note 53584 deleted from function.mime-content-type by bjori
| From: | bjori@php.net | Date: | Tue, 18 Apr 2006 21:03:58 +0000 |
| Subject: | note 53584 deleted from function.mime-content-type by bjori | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-108440@lists.php.net to get a copy of this message | ||
Note Submitter: cfreak at NOSPAM dot gmail dot com
----
Re: sunfra at firenze dot net, 29-Apr-2005 04:31
> if you arern't allowed to use mime_content_type, you can use this
> function
--snip--
This is a very bad idea IMHO since a nefarious user can now upload evil_virus.exe.txt and possibly
trick a user into downloading/executing it. Or exploit other problems in your code to actually run
the code on your server!
As someone else mentioned, if you don't have the mime_content_type function available, if
you're on *nix you can make a system call to the file utility. Since I dont' code on
windoze I'm not sure what the options are, maybe someone else could enlighten us.