PHP Upload script for ZIP/SIT files

Question

Hi,
I'm trying to locate a decent script that would allow clients
to upload files to a Web site that I am working on. I found a basic
one that works at www.w3schools.com/PHP/php_file_upload.asp.
However, it lack the capabilities to upload zip and sit files.
Could I modify the existing script that I just mentioned?
Unfortunately, I am not very PHP saavy. I have been Googling for
such a script but have not found one yet. I hope some one could
recommend a decent script. Thanks.

Answer 1

.oO(Mark A. Boyd)
>Carlton Chin posted in macromedia.dreamweaver.appdev:
>
>> I'm trying to locate a decent script that would
allow clients to
>> upload files to a Web site that I am working on. I
found a basic
>> one that works at
www.w3schools.com/PHP/php_file_upload.asp.
>> However, it lack the capabilities to upload zip and
sit files.
>> Could I modify the existing script that I just
mentioned?
>
>The ticket is where the script is checking
$_FILES["file"]["type"].
>See
http://www.w3schools.com/media/media_mimeref.asp
>
>If you only want to allow zip/sit, try changing this:
>
><?php
>if ((($_FILES["file"]["type"] == "image/gif")
>|| ($_FILES["file"]["type"] == "image/jpeg")
>|| ($_FILES["file"]["type"] == "image/pjpeg"))
>&& ($_FILES["file"]["size"] < 20000))
Be careful. These informations can be faked or might not be
available at
all. I can easily upload a PHP script as "image/jpeg". If the
file ends
up in a public directory within the document root, I can
execute it and
then have a look at the entire server ...
Relying on the content type or file extension is a huge
security hole!
I'm quite surprised that W3Schools publishes such an insecure
script.
To make sure that an uploaded file is really of the type you
expect, you
must look at its content! For images you can use
getimagesize(), which
will also return the type if it's a valid image. For other
types you
have to use other libs or external tools. On a *nix machine
you could
execute the shell command 'file' for example, which
recognizes quite a
lot of different file types.
Micha