PHP and MySQL Web Development 4th Ed-tqw-_darksiderg

438 Chapter 19 Interacting with the File System and the Server
To ensure that you are not vulnerable, this script uses the is_uploaded_file() and
move_uploaded_file() functions to make sure that the file you are processing has actually
been uploaded and is not a local file such as /etc/passwd.This function is available
from PHP version 4.0.3 onward.
Unless you write your upload handling script carefully, a malicious visitor could provide
his own temporary filename and convince your script to handle that file as though
it were the uploaded file. Because many file upload scripts echo the uploaded data back
to the user or store it somewhere that it can be loaded, this could lead to people being
able to access any file that the web server can read.This could include sensitive files such
as /etc/passwd and PHP source code including your database passwords.
Avoiding Common Upload Problems
Keep the following points in mind when performing file uploads:
n The previous example assumes that users have been authenticated elsewhere.You
shouldn’t allow just anybody to upload files to your site.
n If you are allowing untrusted or unauthenticated users to upload files, it’s a good
idea to be paranoid about the contents of the files.The last thing you want is a
malicious script being uploaded and run.You should be careful, not just of the type
and contents of the file as we are here, but of the filename itself. It’s a good idea to
rename uploaded files to something you know to be “safe.”
n To mitigate the risk of users “directory surfing” on your server, you can use the
basename() function to modify the names of incoming files. This function will
strip off any directory paths that are passed in as part of the filename, which is a
common attack that is used to place a file in a different directory on your server.
An example of this function is as follows: