Home > php教程 > php手册 > is_uploaded_file疑惑

is_uploaded_file疑惑

WBOY
Release: 2016-06-13 09:52:56
Original
787 people have browsed it




is_uploaded_file疑惑

如果 filename 所给出的文件是通过 HTTP POST 上传的则返回 TRUE。这可以用来确保恶意的用户无法欺骗脚本去访问本不能访问的文件,例如 /etc/passwd
这里的 /etc/passwd 指的是什么?希望朋友们帮我详细解答下 (恶意的用户无法欺骗脚本去访问本不能访问的文件)这段话又是什么意思,什么叫去访问本不能访问的文件 大侠们指点下谢谢了
$classnotes = "./".$_FILES['classnotes']['name'];

copy($_FILES['classnotes']['tmp_name'],"./classnotes/".basename($classnotes));


复制代码if(is_uploaded_file($_FILES['classnotes']['tmp_name'])){

copy($_FILES['classnotes']['tmp_name'],"./classnotes/".$_FILES['classnotes']['name']);

}else{

echo "上传失败";

}


复制代码以上这两段代码在安全意义上有区别吗?

[ ]

我来回答




D8888D回贴内容-------------------------------------------------------
/etc/passwd 是linux里的用户密码文件

D8888D回贴内容-------------------------------------------------------
原帖由 klgd 于 2009-3-6 15:14 发表 [url=http://bbs.111cn.cn/redirect.php?goto=findpost&pid=895665&ptid=107360]链接标记[img]http://bbs.111cn.cn/images/common/back.gif[/img][/url]
/etc/passwd 是linux里的用户密码文件
谢谢这位朋友:-)

D8888D回贴内容-------------------------------------------------------
如果恶意构建一个/etc/passwd,第一个就直接执行了


Related labels:
source:php.cn
Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn
Popular Recommendations
Popular Tutorials
More>
Latest Downloads
More>
Web Effects
Website Source Code
Website Materials
Front End Template