php determines whether image exists

In our daily development, we often need to judge whether the picture exists. If it exists, it will be displayed. If it does not exist, the default picture will be displayed. So how do we judge?

##getimagesize() function (Recommended learning: PHP programming from entry to proficiency)## The #getimagesize function is not part of the GD extension and can be used by standard installed PHP. You can first take a look at the document description of this function:

http://php.net/manual/zh/function.getimagesize.php

If the specified file is not a valid image, false

will be returned. There is also a field indicating the document type in the returned data. If you don't use it to get the size of the file but use it to determine whether the uploaded file is an image file, it seems to be a very good solution. Of course, this requires shielding possible warnings. For example, the code reads like this:

<?php
$filesize = @getimagesize(&#39;/path/to/image.png&#39;);
if ($filesize) {
    do_upload();
}

# 另外需要注意的是，你不可以像下面这样写：
# if ($filesize[2] == 0)
# 因为 $filesize[2] 可能是 1 到 16 之间的整数，但却绝对不对是0。

But if you just do such verification, then unfortunately, you have successfully planted a webshell vulnerability in the code.

To analyze this problem, let’s first take a look at the prototype of this function:

static void php_getimagesize_from_stream(php_stream *stream, zval **info, INTERNAL_FUNCTION_PARAMETERS){
   ...
   itype = php_getimagetype(stream, NULL TSRMLS_CC);    switch( itype) {
       ...
   }
   ...
}static void php_getimagesize_from_any(INTERNAL_FUNCTION_PARAMETERS, int mode) {
   ...
   php_getimagesize_from_stream(stream, info, INTERNAL_FUNCTION_PARAM_PASSTHRU);
   php_stream_close(stream);
}

PHP_FUNCTION(getimagesize)
{
   php_getimagesize_from_any(INTERNAL_FUNCTION_PARAM_PASSTHRU, FROM_PATH);
}

Limited space has hidden some details. Now we know two things from the above code. That’s enough:

The final processing function is php_getimagesize_from_stream

The function responsible for determining the file type is php_getimagetype

Let’s take a look at the implementation of php_getimagetype:

PHPAPI int php_getimagetype(php_stream * stream, char *filetype TSRMLS_DC){
    ...    if (!memcmp(filetype, php_sig_gif, 3)) {        return IMAGE_FILETYPE_GIF;
    } else if (!memcmp(filetype, php_sig_jpg, 3)) {        return IMAGE_FILETYPE_JPEG;
    } else if (!memcmp(filetype, php_sig_png, 3)) {
        ...
    }
}

The above is the detailed content of php determines whether image exists. For more information, please follow other related articles on the PHP Chinese website!