1

我一直在写一个文件上传器，我想验证类型和大小，我目前有这个：

    <?php 

//SETTING UP LOCAL VARIABLES
$username = trim($_POST['username']);
$password = trim($_POST['password']);
$name = trim($_POST['name']);
$email = trim($_POST['email']);
$message = trim($_POST['message']);

//STRIPPED OUT ALL NON ASCII CHARACTERS
$username = preg_replace('/[^(\x20-\x7F)]*/','', $username);
$password = preg_replace('/[^(\x20-\x7F)]*/','', $password);
$name = preg_replace('/[^(\x20-\x7F)]*/','', $name);
//$email = preg_replace('/[^(\x20-\x7F)]*/','', $email);

//SETTING UPLOAD DIR
$upload_dir = $_SERVER['DOCUMENT_ROOT'] . "/beta_images/";

//CREATING A RANDOM HASH TO PROTECT FROM DUPLICATE FILES
$random = rand(1, 100);

$user_hash = $random . $name;

$hash = sha1($user_hash);
$hash = substr($hash, 32, $random);

foreach ($_FILES['file']['error'] as $key => $error) {

$counter++;

if (
(
    ($_FILES['file']['type'][$key] == "image/jpeg")
 || ($_FILES['file']['type'][$key] == "image/pjpeg")
 || ($file['file']['type'][$key] == "image/jpg")
)

&& ($error == UPLOAD_ERR_OK)
&& ($_FILES['file']['size'][$key] < 20971520)
) {

        $temp_name = $_FILES['file']['tmp_name'][$key];
        $image_name = $hash . '_' . $name . $counter . '.jpg';
        move_uploaded_file($temp_name, $upload_dir . $image_name);

    } else {

    $body_fail = "Someone forgot to do something and wound up on the Sorry page. You might want to contact them and try and convince them to join still. Here are the details \n\n Username: $username \n Password: $password \n Email: $email \n Name: $name \n Message: $message";

    mail("bla", "Failed beta sign up", $body_fail);

    header("Location: ../sorry.html");

    }

}

        //EMAIL INTERNAL

            $body_internal = "Success! $name has submitted a beta entry!\n\n Their username is \n $username \n Their password is \n $password \n Their email address is $email.\n\n The images are located in \n /beta_images/{$hash}_{$name}1/2/3.jpg \n\n They also wrote a little message for us: \n$message";

            mail("bla", "New Beta Sign Up", $body_internal);

        //EMAIL INTERNAL

        //EMAIL EXTERNAL

            $body_external = "Thank you for applying to join the Stylistic Gallery, we just wanted to let you know that we have received everything and will be in touch shortly.\n\n Best Wishes \n Stylistic Gallery \n\n The Stylistic Gallery, a portal for creative individuals and businesses to showcase and sell their work online";

            mail($email, "Thank you for your application", $body_external);

        //EMAIL EXTERNAL

        header("Location: ../thanks.html");

但是，即使文件不是 jpg 或大小更大，它仍然会通过。

抱歉含糊其辞，因为现在看太久而感到困惑:)

谢谢！

4

2 回答 2

5

仅仅因为您发出Location:标头并不意味着脚本停止执行。尝试在重定向标头之后放置一个exit;或。die;

此外，您通常应该对描述不遵循重定向的浏览器去哪里的少量内容感到厌烦，例如

die(<<< ERRORTEXT
<!doctype html>
<html><head><title>Error: Foo</title></head><body>
<h1>We're sorry, your call could not be completed as dialed.</h1>
<p><a href="../sorry.html">Click here to continue to your final destination.</a></p>
</body></html>
ERRORTEXT
);

编辑：吹毛求疵

($_FILES['file']['size'][$key] < 20971520)

我们在这里拥有的被称为“幻数”；确定现在很明显，但是在编程或执行方面不会花费更多时间来执行以下操作之一：

($_FILES['file']['size'][$key] < 20 * 1024 * 1024)

或者

define('MAX_FILE_SIZE', 20 * 1024 * 1024); // 20 MB
($_FILES['file']['size'][$key] < MAX_FILE_SIZE)
于 2010-11-03T18:28:58.110 回答
4

你错过了一些括号，你想替换一个 || 经过 ＆＆。

if (
(
    ($_FILES['file']['type'] == "image/jpeg")
 || ($_FILES['file']['type'] == "image/pjpeg")
 || ($_FILES['file']['type'] == "image/jpg")
)

&& ($error == UPLOAD_ERR_OK)
&& ($_FILES['file']['size'] < 20971520)
) {

如果像这样的 if 语句很长，最好将其分解。这是我将如何编写你的循环：

/* ideally you would move those messages to some text files, to make it
 * easy to change any content and eventually localize it.
 */

// mail if upload fails
$failure_mail_body_to_admin = "Someone ...";

// mail to admin after successful upload
$sucess_mail_body_to_admin = "Success! ...";

// mail to user after successful upload
$sucess_mail_body_to_user = "Thank you ...";

// mime types of allowed images, I know that those can be spoofed
$allowed_mime_types = array("image/jpeg", "image/pjpeg", "image/jpg");
$fileCount = 0;

foreach ($_FILES as $filename => $file) {
    $file_is_ok = true;
    // test general errors
    if ($file['error'] != UPLOAD_ERR_OK) {
         $file_is_ok = false;
    }

    // test size (< 20MB)
    if ($file['size'] >= 20971520) {
        $file_is_ok = false;
    }

    if (!in_array($file['type'], $allowed_mime_types) {
        $file_is_ok = false;
    }

    if ($file_is_ok) {
        $fileCount++;

        // store image
        $temp_name = $file['tmp_name'];
        $image_name = $hash . '_' . $name . $counter . '.jpg';
        move_uploaded_file($temp_name, $upload_dir . $image_name);
    }
}

if ($fileCount > 0) {
    // send confirmation mails
    mail("bla", "New Beta Sign Up", $sucess_mail_body_to_user);
    mail($email, "Thank you for your application", $sucess_mail_body_to_admin);

    // redirect user
    header("Location: ../thanks.html");
    die();
} else {
    mail("bla", "Failed beta sign up", $failure_mail_body_to_admin);

    // redirect user
    header("Location: ../sorry.html");
    die;
}
于 2010-11-03T18:18:41.577 回答