diff --git a/features/file-upload.xml b/features/file-upload.xml index d288f4622c..e54beee957 100644 --- a/features/file-upload.xml +++ b/features/file-upload.xml @@ -1,5 +1,5 @@ - + Handling file uploads @@ -111,7 +111,9 @@ The mime type of the file, if the browser provided this information. An example would be - "image/gif". + "image/gif". This mime type is however + not checked on the PHP side and therefore don't take its value + for granted. @@ -196,7 +198,10 @@ print ""; to throw away any files that are either too small or too big. You could use the $_FILES['userfile']['type'] variable - to throw away any files that didn't match a certain type criteria. + to throw away any files that didn't match a certain type criteria, but + use this only as first of a series of checks, because this value + is completely under the control of the client and not checked on the PHP + side. As of PHP 4.2.0, you could use $_FILES['userfile']['error'] and plan your logic according to the error codes.