note 80599 added to features.file-upload

Note that on Windows, EVERY file has execute permission. This means whenever you upload a file from a Windows host, it will have its execute bit set. If you are moving uploaded files to a directory where they will be accessible via HTTP (necessary if e.g. you want to allow uploads of avatars), you *must* use chmod() to make them non-executable after moving them to their intended location. Otherwise, you run the risk that they could be treated by the web server as CGI scripts. If you don't need uploaded files to be accessible directly via http, then use a .htaccess file containing the line "Deny from all" in the directory where you placed them; or, if your web server is set up with public_html directories, place uploaded files in a location *outside* public_html. Note also that the uploaded files won't belong to you, but to the user in whose name httpd is running. And on most systems, only root can chown() files (even if they were your files to begin with). This will mean you can't do file management via FTP / SSH unless you make the files world-writable ..... and you probably don't really want that. (Workaround: put in a password protected script to chmod() files as required, and if for some reason you don't trust Apache's password protection, use your FTP client to make it non-world-readable when it is not needed.) ---- Server IP: 69.147.83.197 Probable Submitter: 85.189.11.2 ---- Manual Page -- http://www.php.net/manual/en/features.file-upload.php Edit -- https://master.php.net/note/edit/80599 Del: integrated -- https://master.php.net/note/delete/80599/integrated Del: useless -- https://master.php.net/note/delete/80599/useless Del: bad code -- https://master.php.net/note/delete/80599/bad+code Del: spam -- https://master.php.net/note/delete/80599/spam Del: non-english -- https://master.php.net/note/delete/80599/non-english Del: in docs -- https://master.php.net/note/delete/80599/in+docs Del: other reasons-- https://master.php.net/note/delete/80599 Reject -- https://master.php.net/note/reject/80599 Search -- https://master.php.net/manage/user-notes.php