hi want my user to upload images to my server. There is a lot of security risks i am aware of, like:
- client side validation is not a good idea.
- PHP code can be embedded into various other data types.(like embeded in a image file)
- by using
$_FILES["file"]["type"]for detecting file type is another risk. - user can use null byte.
so how can i secure my uploads so that user can fake the extensions or embeded the image with php code. or prevent user from bypassing security checks.
here is the code i found on the internet while searching but cant get it to work.
<?php
$userfile = $_POST['user_profile_image'];
//Upload Files
// Configuration
$maxsize = 2097152; // Maximum filesize in BYTES (currently 2MB).
$upload_path = $uploaddir; // The place the files will be uploaded to (currently a 'files' directory).
$filename = $_FILES['userfile']['name']; // Get the name of the file (including file extension).
$ext = substr($filename, strpos($filename,'.'), strlen($filename)-1); // Get the extension from the filename.
// Check if the filetype is allowed, if not DIE and inform the user.
if(!in_array($ext,$allowed_filetypes)){
echo 'Opps! Image Format not allowed!';
exit;
}
list($width,$height,$type,$attr) = getimagesize($_FILES['userfile']['tmp_name']);
$mime = image_type_to_mime_type($type);
if(($mime != "image/jpeg") && ($mime != "image/pjpeg") && ($mime != "image/png")) {
die("<BR><BR>Error3: Upload file type un-recognized. Only .JPG or .PNG images allowed.");
}
// Now check the filesize, if it is too large then DIE and inform the user.
if(filesize($_FILES['photo1']['tmp_name']) > $max_filesize){
echo 'Opps! Image is to big!';
exit;
}
// Check if we can upload to the specified path, if not DIE and inform the user.
if(!is_writable($upload_path)){
die('You cannot upload to the specified directory, please CHMOD it to 777.');
}
//This line assigns a random number to a variable. You could also use a timestamp here if you prefer.
$ran = rand () ;
//This takes the random number (or timestamp) you generated and adds a . on the end, so it is ready of the file extension to be appended.
$ran2 = $ran;
//This assigns the subdirectory you want to save into... make sure it exists!
$target = "./uploads/";
//This combines the directory, the random file name, and the extension
$target = $target . $ran2.$ext;
if(move_uploaded_file($_FILES['userfile']['tmp_name'], $target))
{
echo "<p>Your image was successfully uploaded!</p>
<p><strong>Forums</strong><br />
<input name=\"textfield\" type=\"text\" id=\"textfield\" size=\"75\" value=\"[URL=http://".$siteurl."][IMG]http://".$siteurl.$uploaddir.$ran2.$ext."[/img][/URL]\"/>
</p>
<p><strong>Forums (2)</strong><br />
<input name=\"textfield2\" type=\"text\" id=\"textfield2\" size=\"75\" value=\"[url=http://".$siteurl."][img=".$siteurl.$uploaddir.$ran2.$ext."][/url]\"/>
</p>
<p><strong>Direct Link</strong><br />
<input name=\"textfield4\" type=\"text\" id=\"textfield4\" value=\"".$siteurl.$uploaddir.$ran2.$ext."\" size=\"75\" /><p>
";
}
else
{
echo 'Opps! Looks like we have a problem....<br><br>';
echo '<b>Error: <FONT COLOR="#FF3300"><u>There was a weird error!</u></b></font>';
exit;
exit;
}
?>
i am getting following errors.
Undefined index: user_profile_image in E:\wamp\www\user\test.php on line 3Undefined variable: uploaddir in E:\wamp\www\user\test.php on line 10Undefined index: userfile in E:\wamp\www\user\test.php on line 12Undefined variable: allowed_filetypes in E:\wamp\www\user\test.php on line 16in_array() expects parameter 2 to be array, null given in E:\wamp\www\user\test.php on line 16
my html code (form)
<form name="upload_image" method="post" action="test.php" enctype="multipart/form-data">
<input type="file" name="user_profile_image" style="position:relative; width:90%;">
<button class="btn btn-info" type="submit" style="float:right;z-index:11; border-radius:0px; border:1px solid #fff; margin:15px 15px 15px 5px;"><font face="arial" size="2px">Upload</font></button>
</form>
what is wrong with this code??
If you have any sollution share it.
