note 26856 deleted from features.file-upload by vincent
| From: | vincent@php.net | Date: | Thu, 11 Sep 2003 12:08:05 +0000 |
| Subject: | note 26856 deleted from features.file-upload by vincent | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-56101@lists.php.net to get a copy of this message | ||
Note Submitter: bckman@ix.netcom.com
----
Remember that it is possible for a user to upload a php file. If the user can then figure out your
directory structure, (which they almost certainly can!) they can then run the script and cause all
kinds of mischief!
Use $_FILES['userfile']['name'] to check for the file suffix of the uploaded
file, and if it happens to be 'php' either change the suffix or refuse to place it on your
server
Frank Boumphrey