Is this totally safe or not? I would like a totally safe file uploading script for my new project. Here is the one I found:
<?php
if ((($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/pjpeg"))
&& ($_FILES["file"]["size"] < 20000))
{
if ($_FILES["file"]["error"] > 0)
{
echo "Return Code: " . $_FILES["file"]["error"] . "<br />";
}
else
{
echo "Upload: " . $_FILES["file"]["name"] . "<br />";
echo "Type: " . $_FILES["file"]["type"] . "<br />";
echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />";
if (file_exists("upload/" . $_FILES["file"]["name"]))
{
echo $_FILES["file"]["name"] . " already exists. ";
}
else
{
move_uploaded_file($_FILES["file"]["tmp_name"],
"upload/" . $_FILES["file"]["name"]);
echo "Stored in: " . "upload/" . $_FILES["file"]["name"];
}
}
}
else
{
echo "Invalid file";
}
?>
You can't trust the $_FILES["file"]["type"] for mime types. That information is sent by the browser so it could be faked. It's best to check mime types with mime_content_type or Fileinfo.
One thing to be aware of is MIME Type Detection in Internet Explorer, which can turn your images into a security risk.
Even if a file has the right extension, and is served with an image mime type, if the file itself contains tokens like <html>, <body>, etc, IE (7 and older) may still interpret it as HTML, opening up a possible XSS exploit.
The files with viruses are still going to get through.
Looks ok to me.
Unless files are scanned, there is no totally 100% safe way to do file uploading. Remember, PHP is a scripting language, not a security program language. So it is as safe as you make it. That said, besides limiting the size and type, the only other thing you might be able to do is check for weird file names - weird being what you define for your application.
If you can use a third party service to scan your files (as yahoo scans attatchments for viruses) for virus, that would make the application better, but I don't know of any off the top of my head.
This might be the over-pedantic ramblings of a security analyst, but you should validate all those fields, using regular expressions for example. And the content as well. Otherwise you just can't be sure. One could quite easily trick that code into accepting a file as being an 'image/gif' then embed a script in it that a particular Apache handler might choose to treat as a valid command! (maybe not by default, but when you install a 'cool new Apache module' in the future...)
If you want a 'totally' secure script: Validate EVERYTHING to make sure everything is exactly how you want it and nothing more or less.
Related
<?php
$file= $_FILES["file"]["name"];//file selected in form
echo "Upload: " . $_FILES["file"]["name"] . "<br>";
echo "Type: " . $_FILES["file"]["type"] . "<br>";
echo "Size: " . ($_FILES["file"]["size"] / 1024) . " kB<br>";
echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br>";
move_uploaded_file($_FILES["file"]["tmp_name"],
"c:/EasyPHP-12.1/www/new website/upload/" . $_FILES["file"]["name"]);
echo "Stored in: " . "c:/EasyPHP-12.1/www/new website/upload/" . $_FILES["file"]["name"];
if(($_FILES['file']['size'] >0))
{echo 'imagetrue';$con=mysql_connect('localhost','abc','YES') or die ("con");;
$db=mysql_select_db("website",$con) or die ("db");
$query=mysql_query("insert into website.picture (imagew) values ('$file')") or die('query'); //storing in db}
//echo $_FILES['file']['error'] ;
$query2= mysql_query("select * from website.picture");
$res=mysql_fetch_array($query2);
foreach($res as $row){
$str = "c:/EasyPHP-12.1/www/new website/upload/ ".$row['imagew'];
echo '<img src="'.$str.'" alt="no">' ;}
?>
i am using this script to store image and then displaying it on webpage but it is not working it only displays empty thumbnails...
I'd be very suspect about using absolute paths like c:/EasyPHP-12.1/www/new website/upload/
I'f you're then accessing the page from http://127.0.0.1/new-website (which I presume you are - or something similar) then having windows system pathnames could be a problem - do browsers even read the local filesystem like that ?
Also, it makes it very un-portable for when you move it to another server.
I'd suggest $str = 'upload/'.$row['imagew']; So it's relative to the document hosted in (I presume) 127.0.0.1/new website/image-viewer.php (or whatever you called it)
Check the return value of move_uploaded_file() - if it's false then it has failed. If that's failing try using the relative path :
move_uploaded_file($_FILES["file"]["tmp_name"], "upload/" . $_FILES["file"]["name"]);
This again presumes your script is sitting in 127.0.0.1/new-website
EDIT - NOTE ::: Is your form using enctype="multipart/form-data" ? If it's not then the images never get to the server !
I am following this tutorial to upload a file using php http://www.w3schools.com/php/php_file_upload.asp
<?php
if ($_FILES["file"]["error"] > 0)
{
echo "Error: " . $_FILES["file"]["error"] . "<br />";
}
else
{
echo "Upload: " . $_FILES["file"]["name"] . "<br />";
echo "Type: " . $_FILES["file"]["type"] . "<br />";
echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
echo "Stored in: " . $_FILES["file"]["tmp_name"];
}
?>
Using this, I have to refresh the page or redirect it, is there a way I can just upload it in the background?
Thanks
Do as all the other scripts. Create a hidden iframe, set a target on your form to that iframe and your good to.
Why not using jquery uploads plugins? You can find plenty of them and they doing a wonderful work.
Try jQuery Form Plugin
There are loads of scripts out there to help with file uploads.
Some examples:
http://pixeline.be/experiments/jqUploader/test.php
http://www.uploadify.com/demos/
Just do a google search or two!
But you will need some javascript knowledge.
Use AJAX, to read and write your requests and responses. Search on XMLHttp Requests and that may help. You can do a POST operation there.
I've built a website with a HTML form/ PHP upload for image files, it works well when its running on XAMPP on my local computer but when i've uploaded it to 000webhost most of the time it says invalid file and only sometimes will the images successfully upload. I've tried turning up the max execution time in the php configuration but that doesn't seem to have fixed it. The files i've tried to upload are smaller than the max file size in the php config and have worked on my test machine perfectly.
I find it odd that it works sometimes and doesn't other times and don't really know what to try.
EDIT:
Here is the form
Filename:
if ((($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/pjpeg")
|| ($_FILES["file"]["type"] == "image/png")))
{
if ($_FILES["file"]["error"] > 0)
{
echo "Return Code: " . $_FILES["file"]["error"] . "<br />";
}
else
{
echo "Upload: " . $_FILES["file"]["name"] . "<br />";
echo "Type: " . $_FILES["file"]["type"] . "<br />";
echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />";
move_uploaded_file($_FILES["file"]["tmp_name"],
"churchimages/pauls.jpeg");
echo "Stored in: " . "churchimages/pauls.jpeg";
}
}
else
{
echo "Invalid file";//This is the section I am seeing
}
Your file type detection is relying on $_FILES["file"]["type"], which is sent by the browser and highly unreliable.
A much better way to detect whether an uploaded file is an image is getimagesize().
$info = getimagesize($_FILES["file"]["tmp_name"]);
$allowed_types = array(IMG_GIF, IMG_JPEG, IMG_PNG);
if (in_array($info[2], $allowed_types))
{ .... do stuff ... }
You should check if the upload actually succeeded FIRST, before doing any of the other operations:
if ($_FILES['file']['error'] === UPLOAD_ERR_OK) {
... handle upload...
if (!move_uploaded_file(...)) { // <--important. ALWAYS check if the move worked.
die("File move failed. Data is lost");
}
} else {
die("Upload failed with code " . $_FILES['file']['error']);
}
IN the case where an upload did not occur, then the ['type'] field would not be set, and just saying "invalid file" would be useless - there is no file at all.
As Pekka's pointed out, you should use other methods of determining file type. The ['type'] data in $_FILES is user-provided, and is trivial to forge.
Make sure that you're defining an absolute path for the uploaded files rather than a relative one.
I have had this issue today.. very sad. took about an hour to repair.
Idea: checking for $_FILES["file"]["type"] == "image/gif" at the top of the script is what failed for me. It seems the browser was populating a "BLANK DATA" instead of "image/gif" so my initial check failed each time with "invalid file type"
Question: It seems the browsers are not properly sending across the file type from the tmp directory?
My FIX: remove the file type check.... as stated above it is very unreliable...
Check the PHP file permissions. in ooowebhost you can find it in chmod. change to '777'. otherwise, the file doesn't have permissions to execute/write
I'm uploading files from an iPhone app to PHP using the following code:
<?php
if ($_FILES["media"]["error"] > 0) {
echo "Error: " . $_FILES["media"]["error"] . "<br />";
} else {
echo "Upload: " . $_FILES["media"]["name"];
echo "Type: " . $_FILES["media"]["type"];
echo "Size: " . ($_FILES["media"]["size"] / 1024);
echo "Stored in: " . $_FILES["media"]["tmp_name"];
if (file_exists("uploads/" . $_FILES["media"]["name"])) {
echo $_FILES["media"]["name"] . " already exists. ";
} else {
move_uploaded_file($_FILES["media"]["tmp_name"],
"uploads/" . $_FILES["media"]["name"]);
echo "Stored in: " . "uploads/" . $_FILES["media"]["name"];
}
}
?>
Afterwards, I get the success message saying "uploads/2542543.jpg" - but I can't seem to find where the image is actually stored. Is the filepath relative to the php file (which is in php - and has an uploads folder) or is it absolute from the root??
EDIT: Looks like the file should have ended up in php/uploads/filename.jpg - but it doesn't appear to be making it. I don't quite understand why - anyone have any idea?
This is an absolute path from the root
/uploads/2543.jpg
This is a relative path from your PHP document
uploads/2543.jpg
So you're working with a relative path (note the missing / at the start)
This is defined in php.ini using the upload_tmp_dir directive. If that's not set, it uses the system default, which you can figure out using sys_get_temp_dir. I believe it defaults to /tmp on Linux, and C:\Windows\Temp\ on Windows.
I have this script for uploading a image and content from a form, it works in one project but not the other. I have spent a good few hours trying to debug it, I am hoping someone could point out the issue I might be having. Where there are comments is where I have tried to debug. The first error I got was the "echo invalid file" at the beginning of the last comment. With these specific areas commented out the upload name and type that I am supposed to be grabbing from the form is not being echoed, I am thinking this is where the error is occurring, but can't quite seem to find it. Thanks.
<?php
include("../includes/connect.php");
/*
if ((($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/pjpeg"))
&& ($_FILES["file"]["size"] < 2000000))
{
*/
if ($_FILES["file"]["error"] > 0)
{
echo "Return Code: " . $_FILES["file"]["error"] . "<br />";
}
else
{
echo "Upload: " . $_FILES["file"]["name"] . "<br />";
echo "Type: " . $_FILES["file"]["type"] . "<br />";
echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />";
/* GRAB FORM DATA */
$title = $_POST['title'];
$date = $_POST['date'];
$content = $_POST['content'];
$imageName1 = $_FILES["file"]["name"];
echo $title;
echo "<br/>";
echo $date;
echo "<br/>";
echo $content;
echo "<br/>";
echo $imageName1;
$sql = "INSERT INTO blog (title,date,content,image)VALUES(
\"$title\",
\"$date\",
\"$content\",
\"$imageName1\"
)";
$results = mysql_query($sql)or die(mysql_error());
echo "<br/>";
if (file_exists("../images/blog/" . $_FILES["file"]["name"]))
{
echo $_FILES["file"]["name"] . " already exists. ";
}
else
{
move_uploaded_file($_FILES["file"]["tmp_name"],
"../images/blog/" . $_FILES["file"]["name"]);
echo "Stored in: " . "../images/blog/" . $_FILES["file"]["name"];
}
}
/*
}
else
{
echo "Invalid file" . "<br/>";
echo "Type: " . $_FILES["file"]["type"] . "<br />";
}
*/
//lets create a thumbnail of this uploaded image.
/*
$fileName = $_FILES["file"]["name"];
createThumb($fileName,310,"../images/blog/thumbs/");
function createThumb($thisFileName, $thisThumbWidth, $thisThumbDest){
$thisOriginalFilePath = "../images/blog/". $thisFileName;
list($width, $height) = getimagesize($thisOriginalFilePath);
$imgRatio =$width/$height;
$thisThumbHeight = $thisThumbWidth/$imgRatio;
$thumb = imagecreatetruecolor($thisThumbWidth,$thisThumbHeight);
$source = imagecreatefromjpeg($thisOriginalFilePath);
imagecopyresampled($thumb, $source, 0, 0, 0, 0, $thisThumbWidth,$thisThumbHeight, $width, $height);
$newFileName = $thisThumbDest.$thisFileName;
imagejpeg($thumb,$newFileName, 80);
echo "<p><img src=\"$newFileName\" /></p>";
//header("location: http://www.google.ca");
}
*/
?>
Perhaps you forgot to add enctype="multipart/form-data" method="post" to your HTML form, or have no <input type="file" name="file" id="file" value=""/> in your HTML.
Here's some problems with your script:
The 'error' value in the $_FILES array is not just a boolean, it will tell you if an upload succeeded, or why it failed. The error codes are defined here.
The 'type' value is supplied by the remote client. It's NOT determined by the web server or PHP. As such, doing mime-type verification based on that value is a major hole: it's trivial to forge the supplied type value. Best to use a server-side method, like fileinfo, to determine the actual mime type.
You blindly insert the form data into your insertion query, which leaves you wide open to SQL injection attacks. At least pass the data through mysql_real_escape_string() before building your query, or better yet, use PDO and parameterized queries
You're storing the files with the original client-provided name. You at least check if the filename's already in use, preventing upload collisions/overwriting, but there's also the case where the client's operating system/file system allows characters in filenames that the server's OS/FS do not, which could lead to subtle file "vanished" bugs, or overwriting entirely different files because the invalid characters were filtered out or translated to something else. Since you're using a database to store information about the upload, you can store the original filename in that table, and use the table's primary key (an auto_increment int, right?) as the filename.
Not really a problem, but in terms of efficiency, there's no need to use getimagesize() in your thumb creation function. GD has imagesx() and imagesy() which get the pixel size from a GD image handle. getimagesize() is independent of GD, so you're opening and parsing the source image twice. Again, it's not really a problem, but on a busy site, opening the image only once could be a decent cpu time and memory usage savings.
The error was in the html form file, I had added a name="something" beside the method="post" and enctype="multi/form-data" obviously this was not liked. Thanks RC for pointing me in the right direction. I am not quite sure why I did this.
$_FILES["file"]["error"] is not just a flag.
It has error codes.
Explained in the manual