Learning the best way to securely upload files to a server
Can someone tell me the best way to ensure that only image is uploaded using finfo() thereby preventing hackers from uploading
a malicious files.Assuming I don't want to upload files outside the roots.
1: I check if file exist as follows
2: I check files typeCode:if(file_exists('upload/' . $_FILES['file_upload']['name'])){ die('File with that name already exists.'); }
but I easily bypass this by changing the file type
3: Using getimagesize.Code:if ($_FILES['some_name']['type'] == 'image/jpeg') { //Proceed to accept the file as a valid image }
This was easily bypassed also
Code:$imageinfo = getimagesize($_FILES['image']['tmp_name']); if($imageinfo['mime'] != 'image/gif' && $imageinfo['mime'] != 'image/jpeg') { echo "Sorry, we only accept<br> GIF and JPEG images<a href=lol.php><font color=red size=4>Back</font></a>"; exit; }
Here is my problem using finfo
I tried using finfo but it does not allow images to be uploaded, can some tell me whats the problem with the finfo code below
Code:$finfo = new finfo(FILEINFO_MIME_TYPE); $fileContents = file_get_contents($_FILES['image']['tmp_name']); $mimeType = $finfo->buffer($fileContents); if($finfo['mime'] != 'image/gif' && $imageinfo['mime'] != 'image/jpeg') { echo "Sorry, we only accept GIF and JPEG images"; exit; }



Reply With Quote
Bookmarks