Could I suggest that you use a real check not a filename check. Any old nasty file could be given a .png or whatever extension.
With multiple file fields with the same name array, e.g. name="myfile[]"
For 3 uploaded files, you will get:
$_FILES['myfile']['name'][0]...
$_FILES['myfile']['name'][1]...
$_FILES['myfile']['name'][2]...
$_FILES['myfile']['tmp_name'][0]
$_FILES['myfile']['tmp_name'][1]
$_FILES['myfile']['tmp_name'][2]
Same for ['type'], ['error'], ['size']
So your $_FILES["file[]"]["name"] is meaningless.
The exif_imagetype() function: http://php.net/manual/en/function.exif-imagetype.php may be a safer bet for image type, as it actually reads part of the file.
diafol
Keep Smiling
10,634 posts since Oct 2006
Reputation Points: 1,628
Solved Threads: 1,506
Skill Endorsements: 57
I don't think your code is correct for exif_imagetype. Try something like this:
if (exif_imagetype('image.gif') == IMAGETYPE_GIF) {
echo "this is a gif!!";
}elseif(exif_imagetype('image.gif') == IMAGETYPE_JPEG) {
echo "this is a jpeg";
}
You can use either constants (as above) or the constant values themselves, e.g.
IMAGETYPE_GIF = 1
IMAGETYPE_JPEG = 2
IMAGETYPE_PNG = 3
if (exif_imagetype('image.gif') == 1) {
echo "this is a gif!!";
}elseif(exif_imagetype('image.jpg') == 2) {
echo "this is a jpeg";
}
diafol
Keep Smiling
10,634 posts since Oct 2006
Reputation Points: 1,628
Solved Threads: 1,506
Skill Endorsements: 57
Shouldn't you be using $_FILES['file']['tmp_name'] instead of the actual filename? The filename $_FILES['file']['name'] is just a string, not a file. The file is uploaded to a temporary folder in php and named by $_FILES['file']['tmp_name'].
You'll need to use move_uploaded_file(): http://php.net/manual/en/function.move-uploaded-file.php to store the image file to your uploads directory once you've verified that the file is indeed of the correct type.
So:
if (in_array(exif_imagetype($_FILES['file']['tmp_name']), array(1,2,3) ) && $_FILES["file"]["size"] < 20000000){
//...upload code...
}
diafol
Keep Smiling
10,634 posts since Oct 2006
Reputation Points: 1,628
Solved Threads: 1,506
Skill Endorsements: 57
Question Answered as of 4 Months Ago by
diafol not going to be accessed by the general public so anyone that uploads something harmfull will be hurting themselves
Things like that may come back to haunt you :(
diafol
Keep Smiling
10,634 posts since Oct 2006
Reputation Points: 1,628
Solved Threads: 1,506
Skill Endorsements: 57