Hi
i am new php programmer, and i need your help please
i have a page that allows for public visitors to upload multi images
but some hackers using my page to upload php files by using image forms to hack my website.
i tried to add some code in my page to limit extension (to just upload images and protect to upload php files)
but now working.....
<?php
if(isset($_POST['submit']))
{
//make sure this directory is writable!
$path_thumbs = "Cars/thumb/";
$path_big = "Cars/pictures/";
//the new width of the resized image, in pixels.
$img_thumb_width = 150; //
$extlimit = "yes"; //Limit allowed extensions? (no for all extensions allowed)
//List of allowed extensions if extlimit = yes
$limitedext = array(".gif",".jpg",".png",".jpeg",".bmp","");
//the image -> variables
$file_type = $_FILES['vImage']['type'];
$file_name = $_FILES['vImage']['name'];
$file_size = $_FILES['vImage']['size'];
$file_tmp = $_FILES['vImage']['tmp_name'];
$file_name2 = $_FILES['car_pic2']['name'];
$file_tmp2 = $_FILES['car_pic2']['tmp_name'];
$file_name3 = $_FILES['car_pic3']['name'];
$file_tmp3 = $_FILES['car_pic3']['tmp_name'];
$file_name4 = $_FILES['car_pic4']['name'];
$file_tmp4 = $_FILES['car_pic4']['tmp_name'];
$file_name5 = $_FILES['car_pic5']['name'];
$file_tmp5 = $_FILES['car_pic5']['tmp_name'];
//check if you have selected a file.
/* if(!is_uploaded_file($file_tmp)){
echo "Error: Please select a file to upload!. <br>--<a href=\"$_SERVER[PHP_SELF]\">back</a>";
exit(); //exit the script and don't process the rest of it!
}*/
//check the file's extension
$ext = strrchr($file_name,'.');
$ext = strtolower($ext);
//uh-oh! the file extension is not allowed!
if (($extlimit == "yes") && (!in_array($ext,$limitedext))) {
echo "Wrong file extension. <br>--<a href=\"$_SERVER[PHP_SELF]\">back</a>";
exit();
}
//so, whats the file's extension?
$getExt = explode ('.', $file_name);
$file_ext = $getExt[count($getExt)-1];
//create a random file name
$rand_name = md5(time());
$rand_name= rand(0,999999999);
//the new width variable
$ThumbWidth = $img_thumb_width;
//////////////////////////
// CREATE THE THUMBNAIL //
//////////////////////////
//keep image type
if($file_size){
if($file_type == "image/pjpeg" || $file_type == "image/jpeg"){
$new_img = imagecreatefromjpeg($file_tmp);
}elseif($file_type == "image/x-png" || $file_type == "image/png"){
$new_img = imagecreatefrompng($file_tmp);
}elseif($file_type == "image/gif"){
$new_img = imagecreatefromgif($file_tmp);
}
//list the width and height and keep the height ratio.
list($width, $height) = getimagesize($file_tmp);
//calculate the image ratio
$imgratio=$width/$height;
if ($imgratio>1){
$newwidth = $ThumbWidth;
$newheight = $ThumbWidth/$imgratio;
}else{
$ThumbWidth = 110;
$newheight = $ThumbWidth;
$newwidth = $ThumbWidth*$imgratio;
}
//function for resize image.
if (function_exists(imagecreatetruecolor)){
$resized_img = imagecreatetruecolor($newwidth,$newheight);
}else{
die("Error: Please make sure you have GD library ver 2+");
}
//the resizing is going on here!
imagecopyresized($resized_img, $new_img, 0, 0, 0, 0, $newwidth, $newheight, $width, $height);
//finally, save the image
if($file_name != NULL){
$thumb = $rand_name.$file_name;
}
if($file_name2 != NULL){
$thumb2 = $rand_name.$file_name2;
}
if($file_name3 != NULL){
$thumb3 = $rand_name.$file_name3;
}
if($file_name4 != NULL){
$thumb4 = $rand_name.$file_name4;
}
if($file_name5 != NULL){
$thumb5 = $rand_name.$file_name5;
}
ImageJpeg ($resized_img,"$path_thumbs/$thumb");
ImageDestroy ($resized_img);
ImageDestroy ($new_img);
}
//ok copy the finished file to the thumbnail directory
move_uploaded_file ($file_tmp, "$path_big/$thumb");
move_uploaded_file ($file_tmp2, "$path_big/$thumb2");
move_uploaded_file ($file_tmp3, "$path_big/$thumb3");
move_uploaded_file ($file_tmp4, "$path_big/$thumb4");
move_uploaded_file ($file_tmp5, "$path_big/$thumb5");
}
?>any help please???
