Re: note 57145 rejected from features.file-upload by jome

This note wasn't suposed to be rejected. Please read our 'User Note Editing Guidelines' carefully before editing notes --> http://doc.php.net/php/dochowto/chapter-user-notes.php Nuno ----- Original Message ----- From: <jome@php.net> To: <php-notes@lists.php.net> Sent: Sunday, September 25, 2005 10:31 AM Subject: [PHP-NOTES] note 57145 rejected from features.file-upload by jome

Note Submitter: znoob2 at yahoo dot com ---- As brion at pobox dot com points out, you should be very careful with magic quotes and file uploads. I found that with magic quotes gpc turned on, filenames that have a quote in it, get stripped awfully. Eg. Upload the file "evil'text.txt" $_FILES['file']['name'] is "text.txt" Now the filename looks less evil, but php took it, so now php is evil. Watch out, since you'll never be able to get that evil part unless you turn magic quotes gpc off. -- PHP Notes Mailing List (http://www.php.net/) To unsubscribe, visit: http://www.php.net/unsub.php