note 64087 deleted from features.file-upload by danbrown
| From: | danbrown@php.net | Date: | Sun, 23 Jan 2011 17:03:23 +0000 |
| Subject: | note 64087 deleted from features.file-upload by danbrown | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-176145@lists.php.net to get a copy of this message | ||
Note Submitter: kweechang at yahoo dot com
----
I have the same problem with filename contains single quote. Currently, I am using web-hosting
services, hence I am not able to switch magic_quotes_gpc on/off.
After some study, I have discovered that the cause of the problem is in function basename();
For example:
$windows_filename = "C:\tmpdir\ling's document.doc"
with magic_quotes_gpc on
it becames
$windows_filename = "C:\\tmpdir\\ling\'s document.doc"
if you do a
echo basename($windows_filename)
the result will be
"s document.doc"
which is not correct, but this is exactly what we get from
$_FILES['userfile']['name'];
To work around with this problem, the following solution might work.
Step 1:
a) Include a hidden field "userfilename" in your form.
b) add a javascript to the "file" input. To objective is to dupilcate the full filename
and post it to the host.
<form name="imgform" method="post" action="upload.php"
enctype="multipart/form-data">
<input type="hidden" name="userfilename" id="userfilename">
<input type="file" name="userfile" id="userfile"
size="64" maxlength="256"
onChange="javascript:top.document.imgform.userfilename.value=
top.imgform.userfile.value">
</form>
Step 2:
a) extract the filename from the "userfilename"
<?php
$fileName = $_FILES['userfile']['name'];
$tmpName = $_FILES['userfile']['tmp_name'];
$fileSize = $_FILES['userfile']['size'];
$fileType = $_FILES['userfile']['type'];
$fp = fopen($tmpName, 'r');
$content = fread($fp, $fileSize);
$content = addslashes($content);
fclose($fp);
if(!get_magic_quotes_gpc())
{
$fileName = addslashes($fileName);
} else {
$fileName = addslashes(basename(stripslashes($_POST['userfilename'])));
}
?>