0

我一直在为一些代码苦苦挣扎。我有一个看起来像这样的 html 表单(它真的很坚固,我知道。只是想让它工作):

<form method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>" >
<table>

<tr>
    <td> Name </td>
    <td> <input type="text" name="name" size="30"></td>
</tr>
<tr>
    <td> Email </td> 
    <td> <input type="text" name="email" size="30"></td>
</tr>

<tr> <td>&nbsp;</td><td>&nbsp;</td> </tr>

<tr>
    <td> Title of Article &nbsp;&nbsp;</td>
    <td> <input type="text" name="title" size="40"></td>
</tr>
<tr>
    <td> Course </td>
    <td>
    <select name="course">
    <option>CEG - Computer Architecture I</option>
    <option>BIO - General Biology I</option>
    <option>BIO - General Biology II</option>
    <option>BIO - Introduction to Human Genetics</option>
    </select>
    </td>
</tr>
<tr>
    <td> File </td>
    <td> <input type="file" name="file" id="file"></td>
</tr>

<tr> <td>&nbsp;</td><td>&nbsp;</td> </tr>

<tr>
    <td valign="top"> Additional Info </td>
    <td><textarea rows="3" cols="40" name="info"></textarea></td>
</tr>

</table>

<input type="checkbox" name="agree"> I agree to the points outlined above and am willing to submit my article <br>
<    input type="submit" name="submit" value="Submit">

</form>

这种形式自称,这是我现在所拥有的:

if (isset($_POST['submit'])) {
    if ( !isset($_POST['agree'])   || 
         !isset($_POST['name'])    || 
         !isset($_POST['email'])   ||  
         !isset($_POST['title'])   ||  
         !isset($_POST['course'])  ||  
         !isset($_POST['file'])) {
        echo 'Please complete all required fields<br>';
    } else {
        $name = $_POST['name'];
        $email = $_POST['email'];
        $title = $_POST['title'];
        $course = $_POST['course'];
        $file = $_POST['file'];

        $message  = "Name: ".$name."\n";
        $message .= "Email: ".$email."\n\n";
        $message .= "Title of Article: ".$title."\n";
        $message .= "Program: ".$course."\n\n";
        $message .= "Additional Info: ".$info;

        if ( !preg_match("/.pdf$/", $file) ) {
            echo 'Article must be in pdf format<br>';
            exit;
        }

        require_once 'include/swift_required.php';

        $transport = Swift_MailTransport::newInstance();
        $mailer = Swift_Mailer::newInstance($transport);
        $swift = Swift_Message::newInstance()
            ->setSubject('New Institutum Submission')
            ->setFrom(array($email => $name))
            ->setTo(array('sub@f33r.com'))
            ->setBody($message)
            ->attach(Swift_Attachment::fromPath($file));

        $result = $mailer->send($swift);
        if ($result) {  echo 'Article sent. Please allow required amount of time to review submission.\n';
                        echo 'You will be contacted by email when we go over your submission.'; }
        else {          echo 'Message failed'; }
    }
}

我正在使用正则表达式来检查它是否是 pdf 文件,但我怀疑这是正确的做事方式(因为有人可以重命名具有 pdf 扩展名的文件)。另外,我还没有实现临时上传文件的方法。这是假设我需要在使用 swiftmailer 将其添加为附件之前在本地上传文件(对吗?)。

我至少在正确的轨道上吗?我从来没有以这种方式真正处理过 PHP。

需要一些调试:

        # Create the message
        # ----------------------------------------------------------------
        $name = $_POST['name'];
        $email = $_POST['email'];
        $title = $_POST['title'];
        $course = $_POST['course'];
        $file = $_POST['file'];

        $message  = "Name: ".$name."\n";
        $message .= "Email: ".$email."\n\n";
        $message .= "Title of Article: ".$title."\n";
        $message .= "Program: ".$course."\n\n";
        $message .= "Additional Info: ".$info;

        # Upload temporary files
        # ----------------------------------------------------------------
        $uploaddir = '/home/public/uploads/';
        $uploadfile = $uploaddir . basename($_FILES['file']['name']);
        if (move_uploaded_file($_FILES['file']['tmp_name'], $uploadfile) == false) {
            echo 'Could not move file';
            exit;
        }

        if ($_FILES['file']['type'] != "application/pdf") {
            echo 'Not a pdf file';
            unlink($uploadfile);
            exit;
        }
4

2 回答 2

2

你在你的 上丢失enctype="multipart/form-data"<form>,这也会在它有机会开始之前终止上传。

于 2011-08-08T15:29:19.220 回答
1

您不想检查文件扩展名,因为它可能被操纵。

相反,要走的路是检查 MIME 类型。请参见此处(示例 2)。PDF 文件的 MIME 类型是application/pdf

另请注意Saxoier的评论:

这个答案意味着依赖 Content-Type 是安全的。检查文件是否包含有效内容的最佳方法是使用特定的解析器(例如图像:GD)对其进行解析。如果没有可用的文件,则不要接受可能有害的文件(例如 *.php [使用保存文件的白名单 - 不是黑名单])。

于 2011-08-07T23:58:07.147 回答