make upload file (move_uploaded_file) secure for public usage

[crmpicco]

PHP Code:

/* UPLOADING FILE */
$target_path = "../images/gallery/";
$target_path = $target_path . basename( $_FILES['filename']['name']); 

if(move_uploaded_file($_FILES['filename']['tmp_name'], $target_path)) {
      echo "The file ".  basename( $_FILES['filename']['name']). 
        " has been uploaded";
} else {
      echo "There was an error uploading the file, please try again!";
}

$filename = basename( $_FILES['filename']['name']); 


Form element:

<input type="file" name="filename" id="filename" class="textbox" size="40">

I am looking to make my code as secure as possible, it's basically taking a image from the form field and moving it to a directory on the server. I would also like to check what the file type is - as i'm only wanting to allow gif, png, jpg, bmp etc......

I know that the code isn't safe enough to put up live at the moment.......

Cheers,
Picco

[Inigoesdr]

You can check if the image is valid by creating an image pointer with it via imagecreatefromjpeg() for example if it is a jpeg, and testing the return.

PHP Code:

$im = imagecreatefromjpeg('/path/to/image.jpg');
if(!$im)
{
    // failed, err msg
}
else
{
    // valid
}
imagedestroy($im); 


There are of course examples and comments in the manual that can help you further.

[idalatob]

To make sure that it is an image you can try using getimagesize on the uploaded image, or you can try using this little stunner:

PHP Code:

$filename = $_FILES['image_upload']
$mime_type = explode("/", $filename['type']); 
if ($mime_type[0] == "image"){ /*Success*/} else { /*failure*/} 


[crmpicco]

thanks for those replies, however I noticed that the first example is using imagecreatefromjpeg. Which i take it would only work if the image uploaded was infact a .jpg file.

The second example is using $mime_type which looks good, but is that a built-in PHP function?

Picco

[Fumigator]

Use imagecreatefromgif() and imagecreatefrompng() as well. (Windows BMP files will require a 3rd party function which you can download from JPEXS).