Join David Powers for an in-depth discussion in this video Restricting acceptable file-name extensions, part of PHP: Uploading Files Securely.
…As it stands, the UploadFile class restricts uploads to specific MIME types.…You could of course, expand the permittedTypes array…but there are hundreds of MIME types registered.…A practical alternative is to allowAllTypes but to append a…suffix to the filename of types that might pose a risk.…So let's begin by creating some new class properties.…They'll all be protected and they'll all go at…the top of the class definition. So protected, and the first one…will be typeCheckingOn, and we'll set this to default true.…
So that means the default of the class will be to check the MIME types.…Next, we need a list of potentially risky file name extensions.…We'll call that notTrusted and I'm just going to paste…in here a list of potentially risky file name extensions.…You can find a copy of that list in a text file in the exercise files for this video.…And then we'll have a default suffix and we'll set that by default to .upload.…
Notice that I put a leading dot on the default suffix.…But the list of extensions,…
At the end of this course, you'll have a robust, flexible class that can be incorporated into many projects (including web forms) with just a few lines of code.
- How PHP handles file uploads
- Setting the maximum file size
- Moving the file to its destination
- Creating and using a namespaced class
- Displaying error messages
- Restricting unacceptable MIME types and file extensions
- Using the class
- Reporting errors
- Altering the user
Skill Level Intermediate
1. File-Upload Basics
2. Creating a File-Upload Class
Checking the error level5m 7s
3. Making the Class More Secure
4. Handling Multiple File Uploads
5. Using the Class
- Mark as unwatched
- Mark all as unwatched
Are you sure you want to mark all the videos in this course as unwatched?
This will not affect your course history, your reports, or your certificates of completion for this course.Cancel
Take notes with your new membership!
Type in the entry box, then click Enter to save your note.
1:30Press on any video thumbnail to jump immediately to the timecode shown.
Notes are saved with you account but can also be exported as plain text, MS Word, PDF, Google Doc, or Evernote.