Programming PHP

as /etc/passwd or /home/rasmus/.forward.You can use the browser-supplied name for
all user interaction, but generate a unique name yourself to actually call the file.For
example:
$browser_name = $_FILES['image']['name'];
$temp_name = $_FILES['image']['tmp_name'];
echo "Thanks for sending me $browser_name.";
$counter++; // persistent variable
$my_name = "image_$counter";
if (is_uploaded_file($temp_name)) {
move_uploaded_file($temp_name, "/web/images/$my_name");
} else {
die("There was a problem processing the file.");
}
Beware of Filling Your Filesystem
Another trap is the size of uploaded files.Although you can tell the browser the maximum
size of file to upload, this is only a recommendation and it cannot ensure that
your script won’t be handed a file of a larger size.The danger is that an attacker will
try a denial of service attack by sending you several large files in one request and filling
up the filesystem in which PHP stores the decoded files.
Set the post_max_size configuration option in php.ini to the maximum size (in bytes)
that you want:
post_max_size = 1024768 ; one megabyte
The default 10 MB is probably larger than most sites require.
Surviving register_globals
The default variables_order processes GET and POST parameters before cookies.
This makes it possible for the user to send a cookie that overwrites the global variable
you think contains information on your uploaded file.To avoid being tricked
like this, check the given file was actually an uploaded file using the is_uploaded_
file( ) function.
In this example, the name of the file input element is “uploaded”:
if (is_uploaded_file($_FILES['uploaded_file']['tmp_name'])) {
if ($fp = fopen($_FILES['uploaded_file']['tmp_name'], 'r')) {
$text = fread($fp, filesize($_FILES['uploaded_file']['tmp_name']));
fclose($fp);
// do something with the file's contents
}
}
PHP provides a move_uploaded_file( ) function that moves the file only if it was an
uploaded file.This is preferable to moving the file directly with a system-level
290 | Chapter 12: Security
This is the Title of the Book, eMatter Edition
Copyright © 2002 O’Reilly & Associates, Inc. All rights reserved.