PHP File upload application & Importance of File validation.

By nimbus01 | 7287 Reads |

0     0

• Here is a sample script for a very basic yet functional image upload application:

The target audience for this article is to the beginner web developer and the main objective is to shed light on the importance of validating "file types" that you would allow users to upload to your server; it is NOT on how to build the perfect file upload application.

A couple years ago I got into Web Development. One of my first assignments was to develop an image upload application for a client. I was very “new” to this field so I had no idea what I was doing. So I think I did what most noobs do - look around online for scripts in code banks and “take a snippet of code here and there” until you make what you need.

My tragedy was I had no clue to the functionality of certain lines of code, so to ease my confusion I omitted certain lines of code in my final application to offer the BARE BASIC MINIMUM of what was required, and that was to Upload the damn file…Not taking into consideration of what “file types” would be allowed and/or not allowed! Big Mistake! Internet Security was never a concern of mine back then, because after all, who would want to hack my site or my client’s site, right?! ~smirk

Several months later when working on a similar project I realized my error and corrected the problem. The problem is this; without validating the "file type" (or even file size in some cases) being uploaded to your server anyone can essentially upload data to your server that you never intended to host. In my case, my application was “intended” to upload “images” but in its original development it was an open gateway for anyone to upload anything they wanted (i.e. junk files, malicious files etc). It doesn’t take a lot of imagination for a seasoned script kiddie to figure a crafty way “to pull someone’s pants down, grease’em up, and aim for penetration of exploitation” due to this very preventable flaw.

¶Here is a sample script for a very basic yet functional image upload application:

1. <?php
2. if (isset($imagefile)) {
3. $path = "/image/upload/directory/";
4. $path = $path . basename( $_FILES['imagefile']['name']);
5. if ($HTTP_POST_FILES['imagefile']['type']=="image/gif" || $HTTP_POST_FILES['imagefile']['type']=="image/pjpeg" || $HTTP_POST_FILES['imagefile']['type']=="image/jpeg"){
6. if (move_uploaded_file($_FILES['imagefile']['tmp_name'], $path)) {
7. echo "The file ". basename( $_FILES['imagefile']['name']).
8. " has been uploaded";
9. }

10. }else{
    

11. echo "Wrong File Type";
    

12. }
    

13. }
14. ?>
16. <form enctype="multipart/form-data" action="<?php $_SERVER['PHP_SELF'] ?> " method="POST">
17. Choose a file to upload: <input name="imagefile" type="file" /><br />
18. <input type="submit" value="Upload File" />
19. </form>

======================================================= I would like to direct your attention to line 5 (not considering the line break). Basically this is the line of code that sets the parameters for the “upload” to occur.

The parameter being this: "IF" the file type is a “gif”, “pjpeg”, or “jpeg” - than the message, “The file ‘file_name’ has been uploaded successfully” will display (line 7) and the image file will be uploaded to the directory path you set (line 3). Yes you will need to edit this line!

ELSE

"IF" the File type is NOT a “gif”, “pjpeg”, or “jpeg” - than the message, “Wrong File Type” will display (line 9) and the image file will NOT be uploaded.

You can of course modify this for any file type you intend a user to upload to your server (i.e. .txt, .pdf, .doc, .png etc).

As I stated before this article is intended for beginning developer to be aware of the importance of file validation when developing upload applications. I agree, the above example is not the most secure “fool-proof” script but I chose to use it for the sake of simplicity due to its minimal lines of code and merely as a demonstration for the topic of this article. There is a lot more to consider and to be scripted when developing an upload application than what’s included in the above example.

One Final note for the hopeless and clueless like myself, if you finish developing your upload application correctly and you are greeted with the following error message:

Warning: move_uploaded_file(/img/upload/directory/”imagefilename”): failed to open stream: Permission denied in /fileupload/directory/upload.php on line “whatever”

Solution: Try changing permission settings to the actual folder you are allowing users to upload to; that will help!

I hope this helps - nimbus01