Member Avatar for Smudly

My uploader allows the following file formats:

jpg
pdf
gif
png

I tested that if someone was to name a file configure.php.jpg, my uploader allows it to upload

I want to do a check to see if the user has 2 extensions, and if so it will not allow them to upload.

I was thinking of just checking if the file name has two "." (dots) in the name. What function could I use to do this?

Or .. is there a better way?

  • 3 Contributors
  • 2 Replies
  • 83 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by kekkaishi

Dani AI

Generated

Counting dots in a filename is a brittle, superficial test. It can block a few toy cases but does not stop a malicious payload: filenames can be faked, client MIME types lie, and a dangerous file left executable on the server is the real risk. asked the right question; and were also right to point out that filename and client-supplied type are not enough.

A practical, safer workflow:

  • Validate file content on the server (use PHP's Fileinfo or image-specific checks) and only accept MIME types on an allowlist. Map the detected MIME to the one extension you will actually use.
  • Never rely on the uploaded filename. Rename files to a safe, random token and save with the approved extension derived from the content check.
  • Store uploads outside the webroot or configure the upload directory so the webserver will not execute scripts there. Serve files through a controlled download script that sets appropriate headers (Content-Type and Content-Disposition).
  • Enforce size limits, check for known malicious signatures if available, set strict file permissions, and log uploads. Consider antivirus or sandbox scanning for higher-risk environments.

For implementation details see the PHP Fileinfo and image-check docs and OWASP guidance on file-upload risks:
PHP Fileinfo functions
getimagesize() for images
PHP file upload handling
OWASP: Unrestricted File Upload

Recommended Answers

All 2 Replies

Member Avatar for xylude

You could use substr_count() to check for the dots, but you should also check the mime type to make sure it's an image.

Member Avatar for kekkaishi

u could use strrpos function to identify the positions of the dots.
but, i dont think a file would have two extensions. extension is the one that comes after the last dot no matter how many dots a file name has.
if you already do not know about it, you might find the global array $_FILES helpful. $_FILES["file"]["type"] would give you the type of the file.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.