note 117613 added to features.file-upload.post-method

For clarity; the reason you would NOT want to replace the example script with $uploaddir = './'; is because if you have no coded file constraints a nerd could upload a php script with the same name of one of your scripts in the scripts directory. Given the right settings and permissions php-cgi is capable of replacing even php files. Imagine if it replaced the upload post processor file itself. The next "upload" could lead to some easy exploits. Even when replacements are not possible; uploading an .htaccess file could cause some problems, especially if it is sent after the nerd throws in a devious script to use htaccess to redirect to his upload. There are probably more ways of exploiting it. Don't let the nerds get you. More sensible to use a fresh directory for uploads with some form of unique naming algorithm; maybe even a cron job for sanitizing the directory so older files do not linger for too long. ---- Server IP: 72.52.91.14 Probable Submitter: 82.15.229.125 ---- Manual Page -- http://php.net/manual/en/features.file-upload.post-method.php Edit -- https://master.php.net/note/edit/117613 Del: integrated -- https://master.php.net/note/delete/117613/integrated Del: useless -- https://master.php.net/note/delete/117613/useless Del: bad code -- https://master.php.net/note/delete/117613/bad+code Del: spam -- https://master.php.net/note/delete/117613/spam Del: non-english -- https://master.php.net/note/delete/117613/non-english Del: in docs -- https://master.php.net/note/delete/117613/in+docs Del: other reasons-- https://master.php.net/note/delete/117613 Reject -- https://master.php.net/note/reject/117613 Search -- https://master.php.net/manage/user-notes.php