PHP：文件驗證隨機工作

Question

我有一個file-type驗證，檢查image擴展。

然而，當我嘗試上傳文件，如.exe或.mp3和幾乎所有的東西比允許擴展其它：

$allowed_ext = array('jpg', 'jpeg', 'png', 'gif'); 

它隨機的作品，我的意思是，有時候它呼應了錯誤，並且有時錯誤不被回聲。

這是檢查的分機的線路....啄

if (in_array($image_ext, $allowed_ext) === false){ 
     $errors[] = '<font color="red">*File type is not allowed.</font>'; 
    } 

全碼：

if (isset($_FILES['image'], $_POST['album_id'])){ 
    $image_name = $_FILES['image']['name']; 
    $image_size = $_FILES['image']['size']; 
    $image_temp = $_FILES['image']['tmp_name']; 


$allowed_ext = array('jpg', 'jpeg', 'png', 'gif'); 
//seperate thingies 
$tmp = explode('.', $image_name); 
$image_ext = strtolower(end($tmp)); 

$album_id = $_POST['album_id']; 
//error array 
$errors = array(); 

if (empty($image_name)){ 
    $errors[] = '<font color="red">*Please choose a photo.</font>'; 
} 
if (empty($album_id)){ 
    $errors[] = '<font color="red">Invalid album.</font>'; 
} else { 
     // not allowed extension? 
    if (!$allowed_ext){ 
     $errors[] = '<font color="red">*The file type is not supported</font>'; 
    } 

    if (in_array($image_ext, $allowed_ext) === false){ 
     $errors[] = '<font color="red">*File type is not allowed.</font>'; 
    } 
        // 5 MB file 
    if ($image_size > 5242880){ 
     $errors[] = '<font color="red">*Maximum file size is 2MB.</font>'; 
    } 
    if (album_check($album_id) === false){ 
     $errors[] = '<font color="red">*Couldn\'t upload to that album.</font>'; 
    } 
    // puting this in here prevent undefined index error. 
    $caption = $_POST['caption']; 
    if (empty($caption)){ 
     $errors[] = '<font color="red">*Caption cannot be empty</font>'; 
    } 

} 
// check if error, if error, echo errors 
if (!empty($errors)){ 
    foreach ($errors as $error){ 
     echo $error, '<br />'; 
    } 
} else { 
// upload the image if no error 
    upload_image($image_temp, $image_ext, $album_id); 
    header('Location: view_album.php?album_id='.$album_id); 
    exit(); 

    } 

Answer 1

只是檢查extention可能不會根據您的設置是安全的。我可以上傳一個帶有jpg擴展名的PHP文件，如果你的服務器沒有正確安裝，我可以執行它。 我想上傳後會更好地檢查文件類型。

<?php 
$allowed_types=array(
    'image/gif', 
    'image/jpeg', 
    'image/png', 
); 

if (isset($_FILES['image']) { 
    //as the type in $_FILES isnt checked by php, use this. 
    $finfo = new finfo(FILEINFO_MIME); 
    $type = $finfo->file($_FILES['image']['tmp_name']); 
    $mime = substr($type, 0, strpos($type, ';')); 

    if (in_array($mime, $allowed_types) 
    { 
    //allowed 
    } 
} 
?> 

但是您可以使用相同的方法進行擴展。

<?php 
$allowed_ext=array(
    'gif', 
    'jpg', 
    'jpeg', 
    'png', 
); 

if (isset($_FILES['image']) { 
    $t = explode('.',basename($_FILES['image']['name'])); 
    $ext = str_to_lower(array_pop($t)); 
    if (in_array($ext, $allowed_ext) 
    { 
    //allowed 
    } 
} 
?> 

Answer 2

不要把圖像擴展和尺寸驗證在else子句，從代碼刪除else條款

if (isset($_FILES['image'], $_POST['album_id'])) 
{ 
    $image_name = $_FILES['image']['name']; 
    $image_size = $_FILES['image']['size']; 
    $image_temp = $_FILES['image']['tmp_name']; 

    $allowed_ext = array('jpg', 'jpeg', 'png', 'gif'); 
    //seperate thingies 
    $tmp = explode('.', $image_name); 
    $image_ext = strtolower(end($tmp)); 

    $album_id = $_POST['album_id']; 

    //error array 
    $errors = array(); 

if (empty($image_name)) 
{ 
    $errors[] = '<font color="red">*Please choose a photo.</font>'; 
} 

if (empty($album_id)) 
{ 
    $errors[] = '<font color="red">Invalid album.</font>'; 
} 

// not allowed extension? 
if (!$allowed_ext){ 
    $errors[] = '<font color="red">*The file type is not supported</font>'; 
} 

if (in_array($image_ext, $allowed_ext) === false){ 
    $errors[] = '<font color="red">*File type is not allowed.</font>'; 
} 
       // 5 MB file 
if ($image_size > 5242880){ 
    $errors[] = '<font color="red">*Maximum file size is 2MB.</font>'; 
} 
if (album_check($album_id) === false){ 
    $errors[] = '<font color="red">*Couldn\'t upload to that album.</font>'; 
} 
// puting this in here prevent undefined index error. 
$caption = $_POST['caption']; 
if (empty($caption)){ 
    $errors[] = '<font color="red">*Caption cannot be empty</font>'; 
} 


// check if error, if error, echo errors 
if (!empty($errors)) 
{ 
    foreach ($errors as $error) 
    { 
     echo $error, '<br />'; 
    } 
} 
else 
{ 
    // upload the image if no error 
    upload_image($image_temp, $image_ext, $album_id); 
    header('Location: view_album.php?album_id='.$album_id); 
    exit(); 
}