world writeable

neroX · Apr 1, 2002

if i disable this, i cannot upload any image from out side.

but if i don't disable this it would be a security risk because someone can plant bot in this site.

so how can i enable outsite image to download without compromise its security.
any suggestion or may be coding.

KarveR · Apr 2, 2002

Heres some code I use, this checks to see that an image has been uploaded and if it isn't an image it gets deleted from the server. - you may want to use the check for filetype on the uploaded file after it has been copied too, but mostly this should get you started.
*note : theres alot of additional crap in here but basically it will help you to see exactly what is happening throughout the upload.
------------
upload.html
########################################################
<html>
<head>
<title>piccy upload</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>
<body>
<form enctype="multipart/form-data" action="uploaded.php" method="post">
<table width="100%" border="0" cellspacing="0" cellpadding="0" align="center">
<tr>
<td>
<div align="center">
<input type="hidden" name="MAX_FILE_SIZE" value="100000">
<input name="userfile" type="file">
<input type="submit" value="Send File" name="submit">
</div>
</td>
</tr>
</table>
</form>
</body>
</html>
##########################################################
------------
uploaded.php
##########################################################
<?php

if (is_uploaded_file($HTTP_POST_FILES['userfile']['tmp_name'])) {

echo "Temp name: $userfile <br>Name: $userfile_name <br>Size: $userfile_size<br> type: $userfile_type <br>";

if ($userfile_name != "." && $userfile_name != ".." && (ereg("\\.gif\$",$userfile_name) || ereg("\\.jpg\$",$userfile_name))) {

echo "File: [$userfile_name] is an image";
echo "<hr>";
copy($userfile, "../uploaded/$userfile_name&quot

;
Echo "<img src=../uploaded/$userfile_name>";
unlink($userfile);
}else{

echo "$userfile is not an image<br>";
if (file_exists($userfile)) {
unlink("$userfile&quot

;
echo "File: $userfile DELETED!";
}
}

}else {

echo "No file uploaded!";
}

?> ***************************************
Party on, dudes!

Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

world writeable

neroX

Programmer

KarveR

MIS

Similar threads

Part and Inventory Search

Sponsor