image - PHP: File Validation randomly works -


i have file-type validation checks image extensions.

however, when try upload files such .exe or .mp3 , other allowed extension :

 $allowed_ext = array('jpg', 'jpeg', 'png', 'gif');

it randomly works, mean, echoes out error , errors not being echo-ed.

this line checks extension.... thingy

    if (in_array($image_ext, $allowed_ext) === false){         $errors[] = '<font color="red">*file type not allowed.</font>';     }

full code: 

if (isset($_files['image'], $_post['album_id'])){     $image_name = $_files['image']['name'];     $image_size = $_files['image']['size'];     $image_temp = $_files['image']['tmp_name'];   $allowed_ext = array('jpg', 'jpeg', 'png', 'gif'); //seperate thingies $tmp = explode('.', $image_name); $image_ext = strtolower(end($tmp));  $album_id = $_post['album_id']; //error array $errors = array();  if (empty($image_name)){     $errors[] = '<font color="red">*please choose photo.</font>'; }  if (empty($album_id)){       $errors[] = '<font color="red">invalid album.</font>'; } else {         // not allowed extension?     if (!$allowed_ext){         $errors[] = '<font color="red">*the file type not supported</font>';     }      if (in_array($image_ext, $allowed_ext) === false){         $errors[] = '<font color="red">*file type not allowed.</font>';     }                        // 5 mb file     if ($image_size > 5242880 ){         $errors[] = '<font color="red">*maximum file size 2mb.</font>';     }     if (album_check($album_id) === false){         $errors[] = '<font color="red">*couldn\'t upload album.</font>';     }     // puting in here prevent undefined index error.      $caption = $_post['caption'];     if (empty($caption)){         $errors[] = '<font color="red">*caption cannot empty</font>';     }  } // check if error, if error, echo errors if (!empty($errors)){     foreach ($errors $error){         echo $error, '<br />';     } } else { // upload image if no error     upload_image($image_temp, $image_ext, $album_id);     header('location: view_album.php?album_id='.$album_id);     exit();    }

just checking extention might not secure depending on setup. upload php file jpg extention , if server isnt setup properly, execute it. guess better check filetype after uploading.

<?php $allowed_types=array(     'image/gif',     'image/jpeg',     'image/png', );  if (isset($_files['image']) {   //as type in $_files isnt checked php, use this.   $finfo = new finfo(fileinfo_mime);   $type = $finfo->file($_files['image']['tmp_name']);   $mime = substr($type, 0, strpos($type, ';'));    if (in_array($mime, $allowed_types)   {      //allowed   } } ?>

but use same approach extention.

<?php $allowed_ext=array(     'gif',     'jpg',     'jpeg',     'png', );  if (isset($_files['image']) {   $t = explode('.',basename($_files['image']['name']));   $ext = str_to_lower(array_pop($t));   if (in_array($ext, $allowed_ext)   {      //allowed   } } ?>

Comments

Post a Comment

Popular posts from this blog

c# - DetailsView in ASP.Net - How to add another column on the side/add a control in each row? -

i have detailsview control on page used edit various fields of record, works in respect. i looking way add 1 column (and if works, why not more) right, absolutely read-only, show same fields of record comparison purposes. i aware there no obvious way such thing out of box detailsview . have looked other controls (transposed gridview , recommended formview , listview ), nothing satisfies. have special data binding setup using detailsview , can't out of without losing features. anyone on how "hack in" additional columns (for display only) on detailsview ? the solution have now, use second detailsview , visible set false in aspx. in code, make sure databind hidden detailsview hosts data third column first, initial detailsview named itemdetails . and in item created event, pass third column html rendering of hidden controls (in last code block) : protected void itemdetails_itemcreated(object sender, eventargs e) { if (dataite
Read more

javascript - firefox memory leak -

i have following script (i use raphaeljs also) draws circle, waits 1 second, draws circle again, etc (you can copy paste - functional, need include raphael raphaeljs.com): <div id="holder"> </div> <script src="raphael.js" type="text/javascript"></script> <script> var paper = raphael(10, 50, 320, 200); var rad = math.pi / 180; var finangle = 0; function sector(cx, cy, r, startangle, endangle, params) { var x1 = cx + r * math.cos(-startangle * rad), x2 = cx + r * math.cos(-endangle * rad), y1 = cy + r * math.sin(-startangle * rad), y2 = cy + r * math.sin(-endangle * rad); return ["m", cx, cy, "l", x1, y1, "a", r, r, 0, +(endangle - startangle > 180), 0, x2, y2]; } var path = sector(100,100,50,0,180); var arc = paper.path(path); function draw() { path = sector(100,100,50,0,finangle);
Read more

Trying to import CSV file to a SQL Server database using asp.net and c# - can't find what I'm missing -

i student , quite new programming, , given task using asp.net , c#, without being taught either. plan learn teach ourselves. the task stuck on making website import csv file sql server database of last year's room bookings around campus. the table has following columns: request_id; priority; module_id; day; start_time; length; park; students; room_code; status; semester_id; linked_request; week_1; week_2; week_3; week_4; week_5; week_6; week_7; week_8; week_9; week_10; week_11; week_12; week_13; week_14; week_15; ) in code, try make work 3 columns (request_id,priority,module) starters. when press import button, want read .csv file (with fixed name @ fixed directory) eg "1,2,3" - comma separating fields [delimiter] - , import sql server datab
Read more