note 106294 added to reserved.variables.files

the ['type'] variable *IS* provided by the client, and should accordingly be treated as potentially harmful (so don't go inserting it directly into an SQL DB, or assume that something with the "image/gif" type really is a GIF). As stated at http://us.php.net/manual/en/features.file-upload.post-method.php : "You could use the $_FILES['userfile']['type'] variable to throw away any files that didn't match a certain type criteria, but use this only as first of a series of checks, because this value is completely under the control of the client and not checked on the PHP side." ---- Server IP: 208.69.120.55 Probable Submitter: 65.96.87.69 ---- Manual Page -- http://www.php.net/manual/en/reserved.variables.files.php Edit -- https://master.php.net/note/edit/106294 Del: integrated -- https://master.php.net/note/delete/106294/integrated Del: useless -- https://master.php.net/note/delete/106294/useless Del: bad code -- https://master.php.net/note/delete/106294/bad+code Del: spam -- https://master.php.net/note/delete/106294/spam Del: non-english -- https://master.php.net/note/delete/106294/non-english Del: in docs -- https://master.php.net/note/delete/106294/in+docs Del: other reasons-- https://master.php.net/note/delete/106294 Reject -- https://master.php.net/note/reject/106294 Search -- https://master.php.net/manage/user-notes.php