Complete explanation of PHP vulnerabilities (9)-File upload vulnerability

Please indicate the source for reprinting: PHP Vulnerability Complete Solution (9) - File Upload Vulnerability

A set of web applications generally provide a file upload function to facilitate visitors to upload some files.

Below is a simple file upload form

form>

php configuration file php.ini, the option upload_max_filesize specifies the file size allowed to be uploaded, the default is 2M

$_FILES array variable

PHP uses the variable $_FILES to upload files, $_FILES is an array. If you upload test.txt, the contents of the $_FILES array are:

$FILES
Array
{
[file] => Array
{
[name] => test.txt //File name
[type] => text/plain //MIME type
[tmp_name] => /tmp/php5D.tmp //Temporary file
[error] => 0 //Error message
[size] => 536 //File size, unit bytes
}
}
If the name attribute value of the upload file button is file

Then use $_FILES[' file']['name'] to get the name of the file uploaded by the client, excluding the path. Use $_FILES['file']['tmp_name'] to obtain the temporary file path where the server saves the uploaded file

The folder where the uploaded file is stored

PHP will not directly place the uploaded file in the root directory of the website, but Save as a temporary file, the name is the value of $_FILES['file']['tmp_name']. The developer must copy this temporary file to the website folder where it is stored.

The value of $_FILES['file']['tmp_name'] is set by PHP and is different from the original name of the file. Developers must use $_FILES['file']['name'] to obtain the value of the uploaded file. Original name.

Error information when uploading files

$_FILES['file']['error'] variable is used to save error information when uploading files. Its value is as follows:

Error information	Value	Description
UPLOAD_ERR_OK	0	No error
UPLOAD_ERR_INI_SIZE	1	The size of the uploaded file exceeds the php.ini setting
UPLO AD_ERR_FROM_SIZE	2	Upload file size exceeds HTML The value of MAX_FILE_SIZE in the form
UPLOAD_ERR_PARTIAL	3	Only upload part of the file
UPLOAD_ERR_NO_FILE	4	No file upload

File Upload Vulnerability

If you provide website visitors with the function of uploading images, you must be careful that what the visitor uploads may not actually be an image, but a PHP program that can be specified. If the directory where the images are stored is an open folder, the intruder can remotely execute the uploaded PHP file to carry out the attack.

The following is a simple file upload example:

php
// Set the directory for uploaded files
$uploaddir = "D:/www/images/";
// Check whether the file exists
if (isset ($_FILES['file1']))
{
// The full path to be placed in the website directory, including the file name
$uploadfile = $uploaddir . $_FILES['file1']['name'];
/ / Move the path stored on the server to the real file name
move_uploaded_file($_FILES['file1']['tmp_name'], $uploadfile);
}
?>
……

form>

This example does not check the file suffix, you can upload any file, it is very convenient Obvious upload vulnerability

The above is the complete explanation of PHP vulnerabilities (9) - File upload vulnerability. For more related content, please pay attention to the PHP Chinese website (www.php.cn)!