Quantcast
Channel: PHP Freaks: PHP Help
Viewing all articles
Browse latest Browse all 13200

file upload security

$
0
0

Hi. I've used a white list approach to only allow certain file types to be uploaded, but I would like to know if this is enough protection.. I've been reading about editing the htaccess to allow certain file types, if that would be useful as extra protection? I'd like this to be as safe as possible!


    error_reporting(E_ALL);
    ini_set('display_errors', 1);

    $filename = $_FILES['cv']['tmp_name'];
	$finfo = finfo_open(FILEINFO_MIME_TYPE);
	$mime = finfo_file($finfo, $filename);
	finfo_close($finfo);

	switch ($mime) {

		//.pdf
		case 'application/pdf':
			$ok = true;
			break;

		//.doc
		case 'application/msword':
			$ok = true;
			break;

		//.docx
		case 'application/vnd.openxmlformats-officedocument.wordprocessingml.document':
			$ok = true;
			break;
		
		default:
			$ok = false;
			break;
	}

	if($ok){
	
		$target = "CV/";
		$target = $target . basename( $_FILES['cv']['name']) ;
		
		if(move_uploaded_file($_FILES['cv']['tmp_name'], $target))
		{
			echo "The file ". basename( $_FILES['cv']['name']). " has been uploaded <br><br>";
		}
		else 
		{
			echo "Sorry, there was a problem uploading your file.";
		} 
		
	}
	else 
	{
		echo "<p>Oh no, you've chosen the wrong file type!</p>";
	}


Viewing all articles
Browse latest Browse all 13200

Latest Images

Trending Articles



Latest Images