note 26856 added to features.file-upload

Remember that it is possible for a user to upload a php file. If the user can then figure out your directory structure, (which they almost certainly can!) they can then run the script and cause all kinds of mischief! Use $_FILES['userfile']['name'] to check for the file suffix of the uploaded file, and if it happens to be 'php' either change the suffix or refuse to place it on your server Frank Boumphrey -- http://www.php.net/manual/en/features.file-upload.php http://master.php.net/manage/user-notes.php?action=edit+26856 http://master.php.net/manage/user-notes.php?action=delete+26856 http://master.php.net/manage/user-notes.php?action=reject+26856