Using directly $filename, from the CGI param(), in open() is insecure as someone could overwrite your system files by uploading files named "../../../var/www/html/index.html" for example. It is wiser to use a temporary filename and never trust the filename from param().open OUTFILE, "> /tmp/test_upload" or die "error: $!";
In reply to Re: file upload
by choocroot
in thread file upload
by Anonymous Monk
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |