|
|
 |
is_uploaded_file (PHP 3>= 3.0.17, PHP 4 >= 4.0.3) is_uploaded_file -- Tells whether the file was uploaded via HTTP POST Descriptionbool is_uploaded_file ( string filename)
Returns TRUE if the file named by filename was
uploaded via HTTP POST. This is useful to help ensure that a
malicious user hasn't tried to trick the script into working on
files upon which it should not be working--for instance,
/etc/passwd.
This sort of check is especially important if there is any chance
that anything done with uploaded files could reveal their
contents to the user, or even to other users on the same
system.
is_uploaded_file() is available only in
versions of PHP 3 after PHP 3.0.16, and in versions of PHP 4
after 4.0.2. If you are stuck using an earlier version, you can
use the following function to help protect yourself:
Megjegyzés:
The following example will not work in
versions of PHP 4 after 4.0.2. It depends on internal
functionality of PHP which changed after that version.
<?php
/* Userland test for uploaded file. */
function is_uploaded_file($filename) {
if (!$tmp_file = get_cfg_var('upload_tmp_dir')) {
$tmp_file = dirname(tempnam('', ''));
}
$tmp_file .= '/' . basename($filename);
/* User might have trailing slash in php.ini... */
return (ereg_replace('/+', '/', $tmp_file) == $filename);
}
/* This is how to use it, since you also don't have
* move_uploaded_file() in these older versions: */
if (is_uploaded_file($HTTP_POST_FILES['userfile'])) {
copy($HTTP_POST_FILES['userfile'], "/place/to/put/uploaded/file");
} else {
echo "Possible file upload attack: filename '$HTTP_POST_FILES[userfile]'.";
}
?> |
See also move_uploaded_file(), and the section
Handling file uploads
for a simple usage example.
User Contributed Notes
is_uploaded_file |
  |
kemusoft at hotmail dot com
19-Feb-2002 08:12 |
|
Here's a part of a script where you use is_uploaded_file function
/*
checks if you're file is uploaded*/
if (is_uploaded_file($file))
{
/* copy's the file to the dir you want */
copy($file,
"files/$file");
}
|
|
gentecsys at yahoo dot com
25-May-2002 08:54 |
|
I hope that this will help people that are using php over win2k
....
in example like this :
<?php
$realname =
$HTTP_POST_FILES['userfile']['name'];
print $realname;
$path="C:\web";
if
(is_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name']))
{
copy($HTTP_POST_FILES['userfile']['tmp_name'],
"C:/web/$realname");
}
else {
echo "Possible
file upload attack. Filename: " .
$HTTP_POST_FILES['userfile']['name'];
}
move_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name'],
"c:/web/$realname");
?>
not the slash !
If u
try "c:\" it WILL NOT WORK .
using "c:/" is the
answer .
|
|
r3gan at hotmail dot com
17-Jun-2002 07:24 |
|
Remeber, if using $HTTP_POST_FILES inside a function and it doesn't seem to
work, try globalizing the array:
function UploadFile() {
global $HTTP_POST_FILES;
// rest of your code here
} //
end UploadFile
|
|
waitman at emkdesign dot com
26-Aug-2002 04:18 |
|
When troubleshooting a file upload problem with large files it is important
to note that there is a squid cache configuration directive that limits
the maximum request size made by the client. If your ISP uses a
transparent proxy this may be cause for some grief. The default value for
the directive is 1MB.
Documentation available at
http://squid.visolve.com/squid24s1/tuning.htm#request_body_max_size
I
am not sure if using squid as an HTTP Accelerator will also affect the
maximum upload size, without further research.
|
|
troels at NO dot SPAM dot webcode dot dk
14-Oct-2002 07:44 |
|
to get the example to work on windows, youll have to add a line, that
replaces backslashes with slashes. eg.: $filename = str_replace
("\\", "/", $filename);
also, as someone
mentioned, globalizing $HTTP_POST_FILES is a good idea
...
<pre>
/* Userland test for uploaded file.
*/
function is_uploaded_file($filename)
{
global
$HTTP_POST_FILES;
if (!$tmp_file =
get_cfg_var("upload_tmp_dir")) {
$tmp_file =
dirname(tempnam("", ""));
}
$tmp_file .=
"/" . basename($filename);
/* User might have trailing slash
in php.ini... */
// fix for win platform
$filename = str_replace
("\\", "/", $filename);
return
(ereg_replace("/+", "/", $tmp_file) ==
$filename);
}
</pre>
|
|
itadmin at itmusicweb dot co dot uk
28-Nov-2002 01:11 |
|
The example brought out does not work as supposed to:
function
is_uploaded_file($filename) {
if (!$tmp_file =
get_cfg_var('upload_tmp_dir')) {
$tmp_file =
dirname(tempnam('', ''));
}
$tmp_file .= '/' .
basename($filename);
/* User might have trailing slash in
php.ini... */
return (ereg_replace('/+', '/', $tmp_file) ==
$filename);
}
It works only with files under ....4 or 5 kb,
other files automatically get the size of 0 bytes. So something must be
wrong here. Built-in is_uploaded_file() works good.
|
|
|
|
| |
is_readable