Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

PHP: How to sanitize uploaded filenames?

I have a PHP application.

I allow users to upload files to my web application.

Question: What's the best way for me to sanitize the file names of the uploaded documents $_FILES["filename"]["tmp_name"] in PHP?

UPDATE:

Can I take an MD5 of the uploaded filename and use that as the newly assigned filename? If so, how do I do that in PHP?

like image 475
frooyo Avatar asked Sep 20 '10 22:09

frooyo


People also ask

How can change upload file name in PHP?

You can simply change the name of the file by changing the name of the file in the second parameter of move_uploaded_file . $temp = explode(".", $_FILES["file"]["name"]); $newfilename = round(microtime(true)) . '.

What is $_ files [' file Tmp_name ']?

$_FILES['file']['tmp_name'] - The temporary filename of the file in which the uploaded file was stored on the server.


1 Answers

I bet that you also store some information about the file in the database. If this is correct, then you can use the primary key (ID) as a filename on your server and preserve the original filename in the database. This gives you greater flexibility, because you can manipulate the metadata without renaming the actual file.

like image 154
Adam Byrtek Avatar answered Nov 05 '22 22:11

Adam Byrtek