Skip to main content
Information Security

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

Required fields*

6
  • extension of file is .gif. I am using this method if(end(explode(".",'gif')) == "gif"){ upload_file(); } Commented Mar 21, 2013 at 9:16
  • 2
    I'd have voted this answer up if mr.spuratic hadn't suggested that applying a regex to the filename/extension in anyway validates the content or mimetype (even with an end anchor). Yes that's a fairly obvious attack vector - it's not a valid defence strategy. (Potentially hostile) Uploaded content should be stored completely outside the doc root and in the case of files, preferably converted to a different format using lossless compression. How you handle meta-data is a complex question - this is where PHP malware resides - but it may also contain copyright info. Commented Mar 21, 2013 at 9:40
  • My intent was to point out how it was being done incorrectly thus creating the vulnerability, updated and clarified the point I hope. Commented Mar 21, 2013 at 9:53
  • 3
    Please note Apache's support for double extensions: something.php.gif will be handled by PHP in common installations despite the final extension being .gif. Commented Mar 21, 2013 at 10:52
  • Good point, incorporated this and your link, thanks! Commented Mar 21, 2013 at 11:54