note 78230 deleted from function.escapeshellcmd by ezyang
| From: | ezyang@php.net | Date: | Wed, 03 Oct 2007 23:19:08 +0000 |
| Subject: | note 78230 deleted from function.escapeshellcmd by ezyang | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-131051@lists.php.net to get a copy of this message | ||
Note Submitter: ed.at.webspecdesign.com
Reason: bad code
----
@Leon:
Here is a snippet we use for ImageMajick, that doesn't require any shell escaping:
<?php
function imageThumbnail($from, $to, $what)
{
global $PARAM;
if ($what == "quote")
{
$MAX_X = 215;
//$MAX_Y = 215;
}
elseif ($what == 'speaker')
{
$MAX_X = 293;
$MAX_Y = 215;
}
$command = "chmod 777 $to";
system($command);
$command = "convert -geometry ".$MAX_X."x".$MAX_Y." '$from'
'$to'";
system($command);
}
?>
And for the upload:
<?php
if ($_FILES[picture] != 'none' && $_FILES[picture][name] != '')
{
$uploadDir = '../images/uploads/speakers/';
// delete old picture
if (file_exists($uploadDir.$_POST['photo_b']))
{
@unlink($uploadDir.$_POST['photo_b']);
}
copy($_FILES[picture]['tmp_name'], $uploadDir.$lastId.$_FILES[picture][name]);
imageThumbnail($uploadDir.$lastId.$_FILES[picture]['name'],
$uploadDir.$lastId.$_FILES[picture]['name'], 'speaker');
mysql_query("UPDATE
speakers SET picture =
'".$lastId.$_FILES[picture]['name']."' WHERE id =
'".$lastId."' LIMIT 1");
}
?>
We have never had a problem going this route, hopefully you can find some use out if it.