Complete explanation of PHP vulnerabilities (9)-File upload vulnerability

form>

php configuration file php.ini, the option upload_max_filesize specifies the file size allowed to be uploaded, the default is 2M

$_FILES array variable

PHP uses the variable $_FILES to upload files, $_FILES is an array. If you upload test.txt, the contents of the $_FILES array are:

$FILES
Array
{
[file] => Array
{
[name] => test.txt //File name
[type] => text/plain //MIME type
[tmp_name] => /tmp/php5D.tmp //Temporary file
[error] => 0 //Error message
[size] => 536 //File size, unit bytes
}
}
If the name attribute value of the upload file button is file

Then use $_FILES[' file']['name'] to get the name of the file uploaded by the client, excluding the path. Use $_FILES['file']['tmp_name'] to obtain the temporary file path where the server saves the uploaded file

The folder where the uploaded file is stored

PHP will not directly place the uploaded file in the root directory of the website, but Save as a temporary file, the name is the value of $_FILES['file']['tmp_name']. The developer must copy this temporary file to the website folder where it is stored.

The value of $_FILES['file']['tmp_name'] is set by PHP and is different from the original name of the file. Developers must use $_FILES['file']['name'] to obtain the value of the uploaded file. Original name.

Error information when uploading files

$_FILES['file']['error'] variable is used to save error information when uploading files. Its value is as follows:

File Upload Vulnerability

If you provide website visitors with the function of uploading images, you must be careful that what the visitor uploads may not actually be an image, but a PHP program that can be specified. If the directory where the images are stored is an open folder, the intruder can remotely execute the uploaded PHP file to carry out the attack.

The following is a simple file upload example:

php
// Set the directory for uploaded files
$uploaddir = "D:/www/images/";
// Check whether the file exists
if (isset ($_FILES['file1']))
{
// The full path to be placed in the website directory, including the file name
$uploadfile = $uploaddir . $_FILES['file1']['name'];
/ / Move the path stored on the server to the real file name
move_uploaded_file($_FILES['file1']['tmp_name'], $uploadfile);
}
?>
……





form>

This example does not check the file suffix, you can upload any file, it is very convenient Obvious upload vulnerability

The above is the complete explanation of PHP vulnerabilities (9) - File upload vulnerability. For more related content, please pay attention to the PHP Chinese website (www.php.cn)!