Binod's Blog

Today I will be sharing some piece of code for getting the real file extension of the uploaded file. I was working on the CMS few days back and there I made the file upload section but I didn’t checked which type of file is been uploaded. During my testing phase I just tested for jpeg file.[ as it was my target]. I hosted it over my server, it was working fine…

The next day, I received a wall post on Facebook from my friend. Binod, you got a security flaw in ur script. I checked it. What he did was he uploaded his scripted file [PHP file] thru that upload section and started to traverse my whole server files.

Then, I realized I need to check the extension of the file and to block the unwanted extension. (E.g. “php” from “myscript.php”).

Here is some piece of code of my CMS that will be beneficial for the users.

//for the upload page

<input type=”file” name=”myfile” />

//for the submit page

$fileatt = $_FILES['myfile']['tmp_name'];
$filename = $_FILES['myfile']['name'];

//there are Five ways that may be helpful

// 1. The “explode/end” approach
$ext = end(explode(‘.’, $filename));

// 2. The “strrchr” approach
$ext = substr(strrchr($filename, ‘.’), 1);

// 3. The “strrpos” approach
$ext = substr($filename, strrpos($filename, ‘.’) + 1);

// 4. The “preg_replace” approach
$ext = preg_replace(‘/^.*\.([^.]+)$/D’, ‘$1′, $filename);

//5. The “pathinfo” approch
$ext = pathinfo($filename, PATHINFO_EXTENSION);

//Checking The uploaded
if(($ext==”jpg”)||($ext==”jepg”)||($ext==”gif”)||($ext==”png”)){
// Uploading and processing script
}else{
// Error script amd msg
}

This is a listing of some common shortcut keys in different versions Microsoft Windows.

Some shortcut keys below are not supported in all versions of Windows.

The shortcut keys on this page are only applicable for Windows in general.

Most keyboards have a Windows Key (key with a Windows icon). This key provides additional shortcuts for Microsoft Windows. Below is a list of the shortcut keys by combining the Windows key and other keys.