in reply to Re: Security issues when allowing file upload via CGI
in thread Security issues when allowing file upload via CGI
in my web upload scripts, I use this:
$filename =~ tr{:\\}{/}; # convert mac and windows directory sep +erators to unix style $filename =~ s{.*/}{}g; # strip everything before the last sepe +rator $filename =~ s{[^\w\-\.]}{}go; # remove funny characters
|
|---|