English 中文(简体)
Limiting file upload type
原标题:

Simple question. Is there a way to only allow txt files upon uploading? I ve looked around and all I find is text/php, which allows PHP.

$uploaded_type=="text/php

最佳回答

When you upload a file with PHP its stored in the $_FILES array. Within this there is a key called "type" which has the mime type of the file EG $_FILES[ file ][ type ]

So to check it is a txt file you do

if($_FILES[ file ][ type ] ==  text/plain ){
    //Do stuff with it.
}

It s explained very well here. Also, don t rely on file extentions it s very unreliable.

问题回答

Simply put: there s no way. Browsers don t consistently support type limiters on file upload fields (AFAIK that was planned or even is integrated into the HTML standard, but barely implemented at best). Both the file extension and mime-type information are user supplied and hence can t be trusted.

You can really only try to parse the file and see if it validates to whatever format you expect, that s the only reliable way. What you need to be careful with are buffer overflows and the like caused by maliciously malformed files. If all you want are text files, that s probably not such a big deal though.

You could check the mime type of the uploading file. In codeIgniter, this code is used in the upload library:

$this->file_type = preg_replace("/^(.+?);.*$/", "\1", $_FILES[$field][ type ]);

The variable $this->file_type then used to check the upload configuration, to see if the uploaded file is in allowed type or not. You can see the complete code in the CodeIgniter upload library file.

You need to check the file extension of the uploaded file.

There is Pear HttpUpload, it supports this.





相关问题
Brute-force/DoS prevention in PHP [closed]

I am trying to write a script to prevent brute-force login attempts in a website I m building. The logic goes something like this: User sends login information. Check if username and password is ...

please can anyone check this while loop and if condition

<?php $con=mysql_connect("localhost","mts","mts"); if(!con) { die( unable to connect . mysql_error()); } mysql_select_db("mts",$con); /* date_default_timezone_set ("Asia/Calcutta"); $date = ...

定值美元

如何确认来自正确来源的数字。

Generating a drop down list of timezones with PHP

Most sites need some way to show the dates on the site in the users preferred timezone. Below are two lists that I found and then one method using the built in PHP DateTime class in PHP 5. I need ...

Text as watermarking in PHP

I want to create text as a watermark for an image. the water mark should have the following properties front: Impact color: white opacity: 31% Font style: regular, bold Bevel and Emboss size: 30 ...

How does php cast boolean variables?

How does php cast boolean variables? I was trying to save a boolean value to an array: $result["Users"]["is_login"] = true; but when I use debug the is_login value is blank. and when I do ...

热门标签