file-upload vulnerability or just not enough information?

Hi, I've searched through documentation, but found nothing relevant to this. If sb. uses fileupload, let's say using: <form action="whatever.php" method=post enctype=multipart/form-data> <input type=file name=userfile> <input type=submit> </form> and one would say, that: whatever.php: <? $f = fopen($userfile, "r"); fpassthrow($f); ?> displays the uploaded file. but how can one know, that $userfile contains safe filename to work with? what if somebody just invokes whatever.php with: whatever.php?userfile_name=blabla.txt&userfile_size=4096&userfile_type=text/plain&userfile=/etc/passwd (or if somebody does it with POST equivalent, of course...) whatever.php will blindly show up /etc/passwd... if there is an universal way how to detect, that a variable was set from uploading, than it should be stated in documentation, if not, I'd suggest introduction of $HTTP_UPLOADED_FILES or similar array, which would hold the actual filename of the uploaded file, so for the "right" usage: $HTTP_UPLOADED_FILES["userfile"] == "/tmp/php2349827" and for the wrong $HTTP_UPLOADED_FILES["userfile"] would be undefined. please, CC any replies to jakub.skopal@sorcerer.cz, cause I've moved into another company and don't read this box frequently enough... Jakub -- Jakub "RiffRaff" Skopal mailto:j@kubs.cz