但是偶已经解决了,修改了一个php文件,增加上传功能。现在把代码贴出来,大家看有没有漏洞。主要是安全性方面考虑
附上传代码:
<?
error_reporting(0);
$uploaddir='file_image/';
$fname = $_FILES['MyFile']['name'];
$dest=$uploaddir . gmdate("Ydm", time()) . $fname;
if ($_FILES['MyFile']['type']=='image/pjpeg' or $_FILES['MyFile']['type']=='image/gif')
{
if (strtolower(substr($fname,-4))=='.php' or strtolower(substr($fname,-4))=='.exe' or strtolower(substr($fname,-4))=='.bat' or strtolower(substr($fname,-4))=='.asp or strtolower(substr($fname,-4))=='.jsp' or strtolower(substr($fname,-5))=='.aspx' or strtolower(substr($fname,-5))=='.html' or strtolower(substr($fname,-4))=='.htm')
{
print('');
}
else
{
@copy($_FILES['MyFile']['tmp_name'],$dest);
print("");
}
}
else
{
if ($fname'')
{
print('');
}
}
?>
<form ENCTYPE="multipart/form-data" ACTION="" METHOD="POST">
[tr]
[td]
[/td]
[td][/td]
[/tr]
[ 本帖最后由 --- 于 2007-2-8 09:48 编辑 ] |