TheLostGuru Posted July 31, 2007 Share Posted July 31, 2007 I am creating an upload form so users can upload files (1 type of file specifically), but I am semi-aware that there a lot of security threats when it comes to this. What are some precautions I need to take to make sure that my upload form isn't abused? Thanks! Quote Link to comment https://forums.phpfreaks.com/topic/62670-securing-upload-forms/ Share on other sites More sharing options...
lightningstrike Posted July 31, 2007 Share Posted July 31, 2007 You need to check the extension of the file carefully. Make sure that the filename does not have a .php,.cgi,.pl etc. extension. E.g a user could potentially upload a file called test.php.jpg which could execute code. You also want to prevent the user for uploading a file that is too large by checking the temp files size. Also set your php.ini file to limit the post_max_size and upload_max_filesize values to the low-end to prevent easy attacks. Another thing you could do is encrypt the filename and store it in a database to avoid code execution. Quote Link to comment https://forums.phpfreaks.com/topic/62670-securing-upload-forms/#findComment-311943 Share on other sites More sharing options...
TheLostGuru Posted July 31, 2007 Author Share Posted July 31, 2007 Thank you, that was exactly what I was looking for. But with answers come more questions. I know how to do the first suggestion, but I don't know what you mean by editing my php.ini file. Could you please explain that one more. And with the filename. Do I encrypt it with that mcrypt thing? And when I pull it back from the database do I just decrypt the filename? Also, how secure are databases? Do I have to worry about other people getting the information out of them? If so, how do I make them secure. How secure are PHP files? Can people download those from off of my server? Do I have to worry about people getting my password and database information from one of my PHP files? I know that I ask a lot of questions, but I'm trying! Quote Link to comment https://forums.phpfreaks.com/topic/62670-securing-upload-forms/#findComment-312065 Share on other sites More sharing options...
TheLostGuru Posted August 1, 2007 Author Share Posted August 1, 2007 drifted to 3rd page and still in need of help (sorry)... Quote Link to comment https://forums.phpfreaks.com/topic/62670-securing-upload-forms/#findComment-312528 Share on other sites More sharing options...
teng84 Posted August 1, 2007 Share Posted August 1, 2007 your completely lost lol everything you ask will depend on the user it will depend on how you design the php code and the db password look i think your question should be how to secure not how secure Quote Link to comment https://forums.phpfreaks.com/topic/62670-securing-upload-forms/#findComment-312532 Share on other sites More sharing options...
lightningstrike Posted August 1, 2007 Share Posted August 1, 2007 Also, how secure are databases? Do I have to worry about other people getting the information out of them? If so, how do I make them secure. Encrypt the data with mcrypt etc. Also hash passwords with the hash, mhash, libraries. Users can also take advantage of SQL injection to steal data from the tables maliciously. However you should never trust user input from cookies, GET, POST. Use functions like mysql_real_escape_string(), htmlentities, strip_tags, etc. How secure are PHP files? Obviously source code cannot be viewed outside the local network as it is parsed by the PHP engine into html. Can people download those from off of my server? Only though shell access, and FTP. Do I have to worry about people getting my password and database information from one of my PHP files? Unless you write terrible code you should be alright. (e.g. upload script allowing files with .php extension to be uploaded) Quote Link to comment https://forums.phpfreaks.com/topic/62670-securing-upload-forms/#findComment-312542 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.