note 20367 deleted from function.copy by betz
| From: | betz@php.net | Date: | Tue, 23 Sep 2003 09:13:51 +0000 |
| Subject: | note 20367 deleted from function.copy by betz | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-56947@lists.php.net to get a copy of this message | ||
Note Submitter: bbonev at php dot net
----
if you allow user uploads of pictures never forget to check the file extension before copying - a
malicious user may upload php, pl, cgi, shtml, etc files:
$ext=explode('.',$filename);
$ext=strtolower($ext[count($ext)-1]);
if (preg_match('/^(gif|png|jpe?g)$/',$ext)) {
.............