PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

Uploading Files
437
n
UPLOAD_ERR_CANT_WRITE, value 7, means that writing the file to disk failed (introduced
in PHP 5.1.0).
If you want to use an older version of PHP, you can perform a manual version of some
of these checks using sample code in the PHP manual or in older editions of this book.
You also check the MIME type. In this case, we want you to upload text files only, so
test the MIME type by making sure that $_FILES[‘userfile’][‘type’] contains
text/plain.This is really only error checking. It is not security checking.The MIME
type is inferred by the user’s browser from the file extension and passed to your server. If
there were some advantage to be obtained by passing a false one, it would not be hard
for a malicious user to do so.
You then check that the file you are trying to open has actually been uploaded and is
not a local file such as /etc/passwd.We come back to this topic in a moment.
If that all works out okay, you then copy the file into the include directory.We used
/uploads/ in this example; it’s outside the web document tree and therefore a good
place to put files that are to be included elsewhere.
You then open up the file, clean out any stray HTML or PHP tags that might be in
the file using the strip_tags() function, and write the file back. Finally, you display the
contents of the file so the user can see that her file uploaded successfully.
The results of one (successful) run of this script are shown in Figure 19.2.
In September 2000, an exploit was announced that could allow a cracker to fool PHP
file upload scripts into processing a local file as if it had been uploaded.This exploit was
documented on the BUGTRAQ mailing list.You can read the official security advisory
at one of the many BUGTRAQ archives, such as http://lists.insecure.org/bugtraq/
2000/Sep/0237.html.
Figure 19.2 After the file is copied and reformatted, the uploaded file is displayed
as confirmation to the user that the upload was successful.