Quote:
Originally Posted by Switch
PHP Code:
temp.allowed = {"graal","nw","gani","png","gif","mng"}; //still don't get mng :\
temp.t = fileName.tokenize(".");
if (!(t[fileName.size()-1] in allowed)) {
//stuff code stuff
}
Pretty sure that could be used, just replace fileName with whatever you're using to get the file name. Not 100% on that since I don't know if it's possible to check the name. |
Checking file extensions won't prevent malicious users from uploading executable files. You need to check file headers. Essentially, you would use loadlines() to load the first line of the file, and you would check if the file header is located within that. (For instance, GIF files always start with "GIF8").
In the end, though, there's nothing you can do if somebody really wants to upload malicious files. Even checking headers doesn't do much, since the person can simply edit the file header. Hopefully getting an error, even after they've changed extensions, would just make them give up.