note 76563 deleted from features.file-upload by nlopess
| From: | nlopess@php.net | Date: | Fri, 20 Jul 2007 16:05:45 +0000 |
| Subject: | note 76563 deleted from features.file-upload by nlopess | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-128771@lists.php.net to get a copy of this message | ||
Note Submitter: bob
----
Where does the $_FILES['userfile']['name'] variable come from? Is it generated
by the PHP, or is it provided directly from the user? Can I be guaranteed that it does not contain
any slashes or ".." or anything like that; so that a malicious user cannot place files in
directories other than the one intended?
Thanks