sigmasternchen/php-doc-en
1
0
Fork 0
mirror of https://github.com/sigmasternchen/php-doc-en synced 2025-03-16 08:58:56 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Code sample to accompany basic upload validation. (Is this redundant now, or still good to have for users of prior PHP versions?)

Browse source 
git-svn-id: https://svn.php.net/repository/phpdoc/en/trunk@31978 c90b9560-bf6c-de11-be94-00142212c4b1
This commit is contained in:
Ron Chmara 2000-09-05 00:33:09 +00:00
parent 20c94e30b2
commit e5755875e4
1 changed files with 21 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

22
features/file-upload.xml
View file

@ -74,7 +74,23 @@ Send this file: <INPUT NAME="userfile" TYPE="file">
directory. This can be changed by setting the environment variable
<envar>TMPDIR</envar> in the environment in which PHP runs. Setting
it using <function>putenv</function> from within a PHP script will
not work.
not work. This environment variable can also be used to make sure
that other operations are working on uploaded files, as well.
<example>
<title>Validating file uploads.</title>
<programlisting>
&lt?
$validtmpdir = get_cfg_var("upload_tmp_dir");
/* make sure you're using an uploaded file */
if (strstr ("$validtmpdir", "$userfile") != 0){
copy ("$userfile" "/place/to/put/uploaded/file");
} else {
echo "Not an uploaded file!";
exit;
}
?>
</programlisting>
</example>
</simpara>
<simpara>
The PHP script which receives the uploaded file should implement
@ -100,6 +116,10 @@ Send this file: &lt;INPUT NAME=&quot;userfile&quot; TYPE=&quot;file&quot;&gt;
or the corresponding php3_upload_max_filesize Apache .conf directive.
The default is 2 Megabytes.
</simpara>
<simpara>
Not validating which file you operate on may mean that users can access
sensitive information in other directories.
</simpara>
<simpara>
Please note that the CERN httpd seems to strip off everything
starting at the first whitespace in the content-type mime header