Comments on: More secure PHP image upload class tutorial

By: sigam

sigam — Fri, 16 May 2008 20:47:51 +0000

To treat user uploaded image files (gif/jpg/png only) I do as below:

- get basename.
- determine type using exif_imagetype().
- if result is neither IMAGETYPE_GIF nor IMAGETYPE_JPEG nor IMAGETYPE_PNG, discard file.
- give my own name to file with correct extension (see above).
- it\’s now safe to store within a public folder where browsers can access them as images.

I have also read suggestions to chmod the stored files to prevent execution, but I\’m not sure how it improves security as properly named gif/jpg/png files won\’t get executed. Also I believe the files are 644 by default.

By: Green Bang

Green Bang — Fri, 18 Apr 2008 14:01:06 +0000

I have a doubt in the above code.

What if the names are same? I mean say we upload a file named \

By: Code

Code — Wed, 16 Apr 2008 13:01:44 +0000

i have a problem with exif in function exif…exif is enable.
more example to use exif?

thx

By: Karl Schulz

Karl Schulz — Fri, 11 Jan 2008 21:50:28 +0000

$_SERVER[’DOCUMENT_ROOT’].’/tnimg/’.$IM->tmp_image[’name’]

flaw: ‘name’ is user input
example: tmp_image[’name’] = ‘../../../../etc/file’
solution: use basename()

Suggestions:
- finfo_file for file type validation (fileinfo extension)
- just getimagesize (reads header) for “all” images types
- pay attention to damn magic quotes in file names

By: Eric

Eric — Sat, 22 Dec 2007 20:57:33 +0000

The PHP Image Upload Script you have available to download appears to have a major bug within it, if possible email me and I will discuss it further.