Welcome to HBH! If you have tried to register and didn't get a verification email, please using the following link to resend the verification email.

Unsecure Upload In PHP


ghost's Avatar
0 0

Hi, my code for my uploading is unsecure, how would I fix it so that I can prohibit files with certain extensions to be uploaded?

<?php
$target = "uploaded/";
$target = $target . basename( $_FILES['uploaded']['name']) ;
$ok=1;
if(move_uploaded_file($_FILES['uploaded']['tmp_name'], $target))
{
echo "The file ". basename( $_FILES['uploadedfile']['name']). " has been uploaded to <a href='uploaded/'>here.</a>";
}
else {
echo "Sorry, there was a problem uploading your file.";
}
?>```

ghost's Avatar
0 0
if(strpos(basename($_FILES['uploaded']['name'],".php")||
strpos(basename($_FILES['uploaded']['name'],".htm")||
strpos(basename($_FILES['uploaded']['name'],".html")||
strpos(basename($_FILES['uploaded']['name'],".asp")||
strpos(basename($_FILES['uploaded']['name'],".aspx")||
strpos(basename($_FILES['uploaded']['name'],".exe")) {
die("invalid file extension!");
}

you could do that, or use the same check to make sure the file ext. falls within a certain range of extensions.