note 94969 added to function.strpos
| From: | Anonymous at osu1 dot php dot net | Date: | Sat, 05 Dec 2009 08:04:49 +0000 |
| Subject: | note 94969 added to function.strpos | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-163602@lists.php.net to get a copy of this message | ||
Do not use strpos function to check file extension of an uploaded file, I saw around something like
this:
<?php
if (!((strpos($nombre_archivo, "png") || strpos($nombre_archivo, "gif") ||
strpos($nombre_archivo,"jpg"))))
{
echo "La extensión o el tamaño de los archivos no es correcta";
}
else
{
if (move_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name'],
$path.$_FILES['userfile']['name']))
{
echo "El archivo ha sido cargado correctamente.";
}
else
{
echo "Ocurrió algún error al subir el fichero. No pudo guardarse.";
}
}
}
?>
Or either the person could upload something like a file named "placeholderpng.php" and
jeopardise the server.
Instead, use this:
<?php
$comprueba = substr($nombre_archivo,-3);
if (!(($comprueba == "png") || ($comprueba == "gif") || ($comprueba ==
"jpg"))){
//code shortened
?>
----
Server IP: 200.6.154.201
Probable Submitter: 200.84.192.65
----
Manual Page -- http://www.php.net/manual/en/function.strpos.php
Edit -- https://master.php.net/note/edit/94969
Del: integrated -- https://master.php.net/note/delete/94969/integrated
Del: useless -- https://master.php.net/note/delete/94969/useless
Del: bad code -- https://master.php.net/note/delete/94969/bad+code
Del: spam -- https://master.php.net/note/delete/94969/spam
Del: non-english -- https://master.php.net/note/delete/94969/non-english
Del: in docs -- https://master.php.net/note/delete/94969/in+docs
Del: other reasons-- https://master.php.net/note/delete/94969
Reject -- https://master.php.net/note/reject/94969
Search -- https://master.php.net/manage/user-notes.php