PHP 安全手冊 第七條 檔案上傳操作進行規避一些風險

PHP提供了兩個友善的函數以減輕這些理論上的風險：

is_uploaded_file( )

move_uploaded_file( )

如果你需要確定tmp_name中的檔案是一個上傳的檔案，你可以用is_uploaded_file( )：

CODE:

<?php
   $filename = $_FILES['attachment']['tmp_name'];
   if (is_uploaded_file($filename))
  {
    /* $_FILES['attachment']['tmp_name'] is an uploaded file. */
  }
   ?>      

​

​如果你希望隻把上傳的檔案移到一個固定位置，你可以使用move_uploaded_file( )：​

​​

​CODE:​

​​

​ ​

​

<?php
   $old_filename = $_FILES['attachment']['tmp_name'];
  $new_filename = '/path/to/attachment.txt';
   if (move_uploaded_file($old_filename, $new_filename))
  {
    /* $old_filename is an uploaded file, and the move was successful. */
  }
   ?>      

最後你可以用 filesize( ) 來校驗檔案的大小：

CODE:

<?php
  $filename = $_FILES['attachment']['tmp_name'];
  if (is_uploaded_file($filename))
  {
    $size = filesize($filename);
  }
 ?>