PHP：文件验证随机工作

Question

我有一个file-type验证，检查image扩展。

然而，当我尝试上传文件，如.exe或.mp3和几乎所有的东西比允许扩展其它：

$allowed_ext = array('jpg', 'jpeg', 'png', 'gif'); 

它随机的作品，我的意思是，有时候它呼应了错误，并且有时错误不被回声。

这是检查的分机的线路....啄

if (in_array($image_ext, $allowed_ext) === false){ 
     $errors[] = '<font color="red">*File type is not allowed.</font>'; 
    } 

全码：

if (isset($_FILES['image'], $_POST['album_id'])){ 
    $image_name = $_FILES['image']['name']; 
    $image_size = $_FILES['image']['size']; 
    $image_temp = $_FILES['image']['tmp_name']; 


$allowed_ext = array('jpg', 'jpeg', 'png', 'gif'); 
//seperate thingies 
$tmp = explode('.', $image_name); 
$image_ext = strtolower(end($tmp)); 

$album_id = $_POST['album_id']; 
//error array 
$errors = array(); 

if (empty($image_name)){ 
    $errors[] = '<font color="red">*Please choose a photo.</font>'; 
} 
if (empty($album_id)){ 
    $errors[] = '<font color="red">Invalid album.</font>'; 
} else { 
     // not allowed extension? 
    if (!$allowed_ext){ 
     $errors[] = '<font color="red">*The file type is not supported</font>'; 
    } 

    if (in_array($image_ext, $allowed_ext) === false){ 
     $errors[] = '<font color="red">*File type is not allowed.</font>'; 
    } 
        // 5 MB file 
    if ($image_size > 5242880){ 
     $errors[] = '<font color="red">*Maximum file size is 2MB.</font>'; 
    } 
    if (album_check($album_id) === false){ 
     $errors[] = '<font color="red">*Couldn\'t upload to that album.</font>'; 
    } 
    // puting this in here prevent undefined index error. 
    $caption = $_POST['caption']; 
    if (empty($caption)){ 
     $errors[] = '<font color="red">*Caption cannot be empty</font>'; 
    } 

} 
// check if error, if error, echo errors 
if (!empty($errors)){ 
    foreach ($errors as $error){ 
     echo $error, '<br />'; 
    } 
} else { 
// upload the image if no error 
    upload_image($image_temp, $image_ext, $album_id); 
    header('Location: view_album.php?album_id='.$album_id); 
    exit(); 

    } 

Answer 1

只是检查extention可能不会根据您的设置是安全的。我可以上传一个带有jpg扩展名的PHP文件，如果你的服务器没有正确安装，我可以执行它。 我想上传后会更好地检查文件类型。

<?php 
$allowed_types=array(
    'image/gif', 
    'image/jpeg', 
    'image/png', 
); 

if (isset($_FILES['image']) { 
    //as the type in $_FILES isnt checked by php, use this. 
    $finfo = new finfo(FILEINFO_MIME); 
    $type = $finfo->file($_FILES['image']['tmp_name']); 
    $mime = substr($type, 0, strpos($type, ';')); 

    if (in_array($mime, $allowed_types) 
    { 
    //allowed 
    } 
} 
?> 

但是您可以使用相同的方法进行扩展。

<?php 
$allowed_ext=array(
    'gif', 
    'jpg', 
    'jpeg', 
    'png', 
); 

if (isset($_FILES['image']) { 
    $t = explode('.',basename($_FILES['image']['name'])); 
    $ext = str_to_lower(array_pop($t)); 
    if (in_array($ext, $allowed_ext) 
    { 
    //allowed 
    } 
} 
?> 

Answer 2

不要把图像扩展和尺寸验证在else子句，从代码删除else条款

if (isset($_FILES['image'], $_POST['album_id'])) 
{ 
    $image_name = $_FILES['image']['name']; 
    $image_size = $_FILES['image']['size']; 
    $image_temp = $_FILES['image']['tmp_name']; 

    $allowed_ext = array('jpg', 'jpeg', 'png', 'gif'); 
    //seperate thingies 
    $tmp = explode('.', $image_name); 
    $image_ext = strtolower(end($tmp)); 

    $album_id = $_POST['album_id']; 

    //error array 
    $errors = array(); 

if (empty($image_name)) 
{ 
    $errors[] = '<font color="red">*Please choose a photo.</font>'; 
} 

if (empty($album_id)) 
{ 
    $errors[] = '<font color="red">Invalid album.</font>'; 
} 

// not allowed extension? 
if (!$allowed_ext){ 
    $errors[] = '<font color="red">*The file type is not supported</font>'; 
} 

if (in_array($image_ext, $allowed_ext) === false){ 
    $errors[] = '<font color="red">*File type is not allowed.</font>'; 
} 
       // 5 MB file 
if ($image_size > 5242880){ 
    $errors[] = '<font color="red">*Maximum file size is 2MB.</font>'; 
} 
if (album_check($album_id) === false){ 
    $errors[] = '<font color="red">*Couldn\'t upload to that album.</font>'; 
} 
// puting this in here prevent undefined index error. 
$caption = $_POST['caption']; 
if (empty($caption)){ 
    $errors[] = '<font color="red">*Caption cannot be empty</font>'; 
} 


// check if error, if error, echo errors 
if (!empty($errors)) 
{ 
    foreach ($errors as $error) 
    { 
     echo $error, '<br />'; 
    } 
} 
else 
{ 
    // upload the image if no error 
    upload_image($image_temp, $image_ext, $album_id); 
    header('Location: view_album.php?album_id='.$album_id); 
    exit(); 
}