Join David Powers for an in-depth discussion in this video Restricting acceptable MIME types, part of PHP: Uploading Files Securely.
…The upload file class that we've been building accepts any type of file.…This is potentially insecure, particularly if…the upload folder is publicly accessible.…But you can use the type element of the file's…superglobal array to filter uploads and restrict them to specific types.…So let's create a class property to store an array of permitted types.…So we'll create it here with all the other property definitions.…We'll make it protected, and we'll call it…permittedTypes, and it needs to be an array.…
And I'm just going to paste in here a list of image mime types.…You can find that list in the text file in the exercise files for this video.…And then we just need to put a semicolon at the end there.…By the way, this image/pjpg is what was used…by old versions of Internet Explorer for JPEG files.…That's why it's been included there.…Next we need to create a method to check the file's type.…So we'll put that down with our other check methods.…
So we need to find checkSize, and we'll put it in after checkSize.…
At the end of this course, you'll have a robust, flexible class that can be incorporated into many projects (including web forms) with just a few lines of code.
- How PHP handles file uploads
- Setting the maximum file size
- Moving the file to its destination
- Creating and using a namespaced class
- Displaying error messages
- Restricting unacceptable MIME types and file extensions
- Using the class
- Reporting errors
- Altering the user
Skill Level Intermediate
1. File-Upload Basics
2. Creating a File-Upload Class
Checking the error level5m 7s
3. Making the Class More Secure
4. Handling Multiple File Uploads
5. Using the Class
- Mark as unwatched
- Mark all as unwatched
Are you sure you want to mark all the videos in this course as unwatched?
This will not affect your course history, your reports, or your certificates of completion for this course.Cancel
Take notes with your new membership!
Type in the entry box, then click Enter to save your note.
1:30Press on any video thumbnail to jump immediately to the timecode shown.
Notes are saved with you account but can also be exported as plain text, MS Word, PDF, Google Doc, or Evernote.