note 94969 deleted from function.strpos by danbrown
| From: | danbrown@php.net | Date: | Sun, 06 Dec 2009 16:30:57 +0000 |
| Subject: | note 94969 deleted from function.strpos by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-163619@lists.php.net to get a copy of this message | ||
Note Submitter: Anonymous
----
Do not use strpos function to check file extension of an uploaded file, I saw around something like
this:
<?php
if (!((strpos($nombre_archivo, "png") || strpos($nombre_archivo, "gif") ||
strpos($nombre_archivo,"jpg"))))
{
echo "La extensión o el tamaño de los archivos no es correcta";
}
else
{
if (move_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name'],
$path.$_FILES['userfile']['name']))
{
echo "El archivo ha sido cargado correctamente.";
}
else
{
echo "Ocurrió algún error al subir el fichero. No pudo guardarse.";
}
}
}
?>
Or either the person could upload something like a file named "placeholderpng.php" and
jeopardise the server.
Instead, use this:
<?php
$comprueba = substr($nombre_archivo,-3);
if (!(($comprueba == "png") || ($comprueba == "gif") || ($comprueba ==
"jpg"))){
//code shortened
?>