ZEND PHP 5 Certification STUDY GUIDE

Web Programming ” 103
in the example above). It is up to the script to move the file to a safe location if it so
chooses—the temporary copy is automatically destroyed when the script ends.
Inside your script, uploaded files will appear in the $_FILES superglobal array. Each
element of this array will have a key corresponding to the name of the HTML element
that uploaded a file (filedata in our case). The element will, itself, be an array with
the following elements:
name
type
size
tmp_name
error
The original name of the file
The MIME type of the file provided by the browser
The size (in bytes) of the file
The name of the file’s temporary location
The error code associated with this file. A value of
UPLOAD_ERR_OK indicates a successful transfer, while any other
error indicates that something went wrong (for example, the
file was bigger than the maximum allowed size).
The real problem with file uploads is that most—but not all—of the information that
ends up in $_FILES can be spoofed by submitting malicious information as part of the
HTTP transaction. PHP provides some facilities that allow you to determine whether
a file upload is legit. One of them is checking that the error element of your file
upload information array is set to UPLOAD_ERR_OK. You should also check that size is
not zero and that tmp_name is not set to none.
Finally, you can use is_uploaded_file() to determine that a would-be hacker
hasn’t somehow managed to trick PHP into building a temporary file name that, in
reality, points to a different location, and move_uploaded_file() to move an uploaded
file to a different location (a call to the latter function also checks whether the source
file is a valid upload file, so there is no need to call is_uploaded_file() first):
One of the most common mistakes that developers make when dealing with uploaded
files is using the name element of the file data array as the destination when
moving it from its temporary location. Because this piece of information is passed
by the client, doing so opens up a potentially catastrophic security problem in your
code. You should, instead, either generate your own file names, or make sure that
you filter the input data properly before using it (this is discussed in greater detail in
the Security chapter).
Licensed to 482634 - Amber Barrow (itsadmin@deakin.edu.au)