note 57145 added to features.file-upload

As brion at pobox dot com points out, you should be very careful with magic quotes and file uploads. I found that with magic quotes gpc turned on, filenames that have a quote in it, get stripped awfully. Eg. Upload the file "evil'text.txt" $_FILES['file']['name'] is "text.txt" Now the filename looks less evil, but php took it, so now php is evil. Watch out, since you'll never be able to get that evil part unless you turn magic quotes gpc off. ---- Manual Page -- http://www.php.net/manual/en/features.file-upload.php Edit -- http://master.php.net/manage/user-notes.php?action=edit+57145 Delete: added to the manual -- http://master.php.net/manage/user-notes.php?action=delete+57145&report=yes&reason=added+to+the+manual Delete: bad code -- http://master.php.net/manage/user-notes.php?action=delete+57145&report=yes&reason=bad+code Delete: spam -- http://master.php.net/manage/user-notes.php?action=delete+57145&report=yes&reason=spam Delete: useless -- http://master.php.net/manage/user-notes.php?action=delete+57145&report=yes&reason=useless Delete: non-english -- http://master.php.net/manage/user-notes.php?action=delete+57145&report=yes&reason=non-english Delete: already in docs -- http://master.php.net/manage/user-notes.php?action=delete+57145&report=yes&reason=already+in+docs Delete: other reasons -- http://master.php.net/manage/user-notes.php?action=delete+57145&report=yes Reject -- http://master.php.net/manage/user-notes.php?action=reject+57145&report=yes Search -- http://master.php.net/manage/user-notes.php