使用 php上传文件的最佳和安全方式

Question

我花了很多时间在谷歌上寻找用 PHP 上传文件最安全的方法。在那里我发现了一些技术，如检查文件扩展名、重命名文件或许多其他技术，所以请告诉我是否还有其他选择。

Answer 1

这个问题已经在这里问过了。但是您可以使用我自己的代码，因为它既简单又安全。function hc_upload($f,$username='',$verify_type=1,$size=2048){&nbsp; &nbsp; $f=$_FILES[$f];&nbsp; &nbsp; $file_name=strtolower($f['name']);&nbsp; &nbsp; $file_type=strtolower($f['type']);&nbsp; &nbsp; $file_size=strtolower($f['size']);&nbsp; &nbsp; $file_extenstion =end(explode('.',$file_name));&nbsp; &nbsp; $file_extenstion2=strtolower(pathinfo(basename($file_name),PATHINFO_EXTENSION));&nbsp; &nbsp; if($file_extenstion2!=$file_extenstion){&nbsp; &nbsp; &nbsp; &nbsp; $err["error"]=true;&nbsp; &nbsp; &nbsp; &nbsp; $err["message"]="Invalid file extension.";&nbsp; &nbsp; &nbsp; &nbsp; return $err;&nbsp; &nbsp; }&nbsp; &nbsp; if($file_size > $size*1000){&nbsp; &nbsp; &nbsp; &nbsp; $err["error"]=true;&nbsp; &nbsp; &nbsp; &nbsp; $err["message"]="File is too large.";&nbsp; &nbsp; &nbsp; &nbsp; return $err;&nbsp; &nbsp; }&nbsp; &nbsp; $ext_verify=0;&nbsp; &nbsp; if(gettype($verify_type)!='array')&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; $verify_type=(string)$verify_type;&nbsp; &nbsp; &nbsp; &nbsp; if((strpos($verify_type,"1") > -1 || $verify_type=="*") &&&nbsp; $ext_verify==0)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $mimes['ext']=array("jpg","jpeg","gif","png");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $mimes['mime']=array("image/jpg","image/jpeg","image/gif","image/png");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if(in_array($file_extenstion,$mimes['ext']) && in_array($file_type,$mimes['mime'])){$ext_verify=1;}&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; if((strpos($verify_type,"2") > -1 || $verify_type=="*") &&&nbsp; $ext_verify==0)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $mimes['ext']=array("doc","docx","pdf","xls","xlsx","ppt","pptx");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if(in_array($file_extenstion,$mimes['ext'])){$ext_verify=1;}&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; if((strpos($verify_type,"3") > -1 || $verify_type=="*") &&&nbsp; $ext_verify==0)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $mimes['ext']=array("mp3","wav","weba","3gp","mp4","mov","mpeg","avi");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $mimes['mime']=array("audio/mpeg","audio/wav","audio/webm","audio/3gpp","video/3gpp","video/mp4","video/quicktime","video/mpeg","video/x-msvideo");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if(in_array($file_extenstion,$mimes['ext']) && in_array($file_type,$mimes['mime'])){$ext_verify=1;}&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp; else&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; if(array_key_exists("mime",$verify_type) && array_key_exists("ext",$verify_type)){&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if(in_array($file_extenstion,$verify_type['ext']) && in_array($file_type,$verify_type['mime'])){$ext_verify=1;}&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; elseif(array_key_exists("ext",$verify_type)){&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if(in_array($file_extenstion,$verify_type['ext'])){$ext_verify=1;}&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; elseif(array_key_exists("mime",$verify_type)){&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if(in_array($file_type,$verify_type['mime'])){$ext_verify=1;}&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; else{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if(in_array($file_extenstion,$verify_type)){$ext_verify=1;}&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp; if($ext_verify==0){&nbsp; &nbsp; &nbsp; &nbsp; $err["error"]=true;&nbsp; &nbsp; &nbsp; &nbsp; $err["message"]="Seems your file is not valid";&nbsp; &nbsp; &nbsp; &nbsp; return $err;&nbsp; &nbsp; }&nbsp; &nbsp; $upload_dir='upload/'.$username.'/';&nbsp; &nbsp; if(!is_dir($upload_dir)){&nbsp; &nbsp; &nbsp; &nbsp; if(!mkdir($upload_dir,0777,true)){&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $err["error"]=true;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $err["message"]="Unknown error, kindly contact admin";&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return $err;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp; $upload_file=$upload_dir.sha1_file($f['tmp_name']);&nbsp; &nbsp; if(!file_exists($upload_file)){&nbsp; &nbsp; &nbsp; &nbsp; if(!move_uploaded_file($f['tmp_name'], $upload_file)){&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $err["error"]=true;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; $err["message"]="Unknown error, kindly contact admin";&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return $err;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp; $err["error"]=true;&nbsp; &nbsp; $err["message"]="SUCCESS";&nbsp; &nbsp; $err["dir"]=$upload_file;&nbsp; &nbsp; return $err;}HTML 示例代码是<form action="upload.php" method="post" enctype="multipart/form-data">&nbsp; &nbsp; Select image to upload:&nbsp; &nbsp; <input type="file" name="fileToUpload" id="fileToUpload">&nbsp; &nbsp; <input type="submit" value="Upload Image" name="submit"></form>所以只需在php中调用这个函数hc_upload('fileToUpload','',123) 您可以通过给定两个第二个参数和第三个参数的值来为每个用户名创建文件夹两个检查文件是图像或文档还是音频/视频媒体，还可以传递扩展名数组以进行手动检查