note 90248 deleted from function.tempnam by danbrown
| From: | danbrown@php.net | Date: | Sun, 12 Apr 2009 15:36:26 +0000 |
| Subject: | note 90248 deleted from function.tempnam by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-153116@lists.php.net to get a copy of this message | ||
Note Submitter: Security conscious
----
Warning! Many of the suggestions in the other posts here for "custom" tempfile or tempdir
creation using this routine contain race conditions which open a system up to security problems. If
you need a tempfile with a specified suffix inside of a php script, and you happen to be using a
Linux server, you can simply use:
exec('/bin/tempfile -s .pdf', $result);
$tmpfile = $result[0];
Similarly, if you need a tempdir and you are using a Linux server, try:
exec('/bin/mktemp -d', $result);
$tmpdir = $result[0];
It may not be as elegant as using a pure php approach, but you can count on this being secure.