in reply to RE:(2) File Upload Security Question
in thread File Upload Security Question

I am also interested in giving users the ability to upload files to my website. Is it safe to allow users to upload a file as long as I name the file myself? I have an art business and I usually do drawings from photos. Ideally, I would like visitors of my site to be able to submit an image file to my site so I could give them a price quote for a drawing (or painting, etc). Do I need to take other precautions as well? Thanks, Rad (an humble newbie in Dallas)
  • Comment on RE: RE:(2) File Upload Security Question

Replies are listed 'Best First'.
RE:(4) File Upload Security Question
by swiftone (Curate) on Jun 13, 2000 at 00:15 UTC
      Thank you.
      That is *just* what I needed to get going.

      Gratefully,
      Rad

        Not always. There is a class of vulnerabilities known as Arbitrary File Upload. What an attacker will do is, put in the source code for a PHP shell(a web application used to manipulate a server) into a text document and then name it "name.php.jpg". what this is doing is disguising the shell as a JPEG image. This file will be uploaded unless your web application sanitizes the inputted file. So make sure that your web application does sanitize the file by making sure that the data that the file holds is of correct extension.