这些文件中的任何一个都可以在服务器上执行病毒吗？
以下任何文件类型是否会执行病毒或以任何方式损害服务器？
pdf、.png、.jpg、.doc、.docx、.xls、.xlsx、.ppt、.pptx、.gif。
Can any of the below file types execute a virus or harm the server in any way?
pdf, .png, .jpg, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .gif.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
这个问题本身没有理由，正如到目前为止给出的答案一样（我很遗憾地告诉你）。不要将所有这些视为批评：我自己解释一下。
您甚至可以将 TheWorstVirusInTheWorld.exe 上传到您的服务器上，但在实际执行之前它不会有害。除非操作系统和/或其 shell 或其他程序（或脚本）存在严重错误，否则不会自动执行任何代码，即“在系统管理员不知情的情况下”。
请参阅virustotal.com。他们要求您上传可疑的可执行文件，以便判断它们是否是病毒。他们害怕这个吗？天哪，不。这是因为文件被上传到服务器上，然后由一个您可以称为“防病毒”的工具读取，但该工具不会执行它们。
所以问题可能是这样的：“哪种类型的文件可以在我的服务器上安全地执行？”答案是：没有来自未知来源的文件。文件的扩展名完全无关：在 UNIX 系统上，您可以执行设置了“执行”位（=属性）的任何文件（甚至是 .doc）。
黑客和骗子不会按照你的预期行事。他们不会在您的服务器上上传常见病毒，如果他们这样做，他们就必须执行这些病毒，如果他们可以在您的服务器上执行某些内容，那么那么您的服务器已经消失了，你所有清理文件扩展名的努力都是垃圾。
The question itself has no reason to be, as the answers given so far (I'm sorry to tell this). Don't take all of this as a criticism: I explain myself.
You can even upload TheWorstVirusInTheWorld.exe on your server, but it won't be harmful until it's actually executed. Unless the operating system and/or its shell or other programs (or scripts) have severe bugs, no code is executed automagically, in the sense of 'without the sysadmin knowing'.
See virustotal.com. They are requesting you to upload suspicious executables in order to tell whether they're viruses or not. Do they fear this? Hell no. That's because the file is uploaded on the server, and then read by a tool you can call 'antivirus' that doesn't execute them.
So the question can be this one: "which kind of files can be safely executed on my server?" The answer is: no files coming from unknown sources. The extension of the files is totally irrelevant: on UNIX systems you can execute any file (even .doc) that has the 'execute' bit (=attribute) set.
Hackers and lamers won't act as you expect. They're not uploading common viruses on your server, and if they do, they have to execute them, and if they can execute something on your server, well your server is already gone, and all your efforts to sanitize file extensions are rubbish.
@AAA：过程如下：
1）用户上传一个文件，例如test.exe。
2）当服务器收到它时，您提取扩展名并将其与文件名一起存储在数据库中，这样您就可以知道该文件具有类型扩展名。
3）当用户请求文件时，您查询文件扩展名及其名称，将它们组合起来，最后将其发送给用户。
注意：
您可能会遇到重名问题，如果您生成固定长度的随机字符串并在请求文件名时将其与文件名一起传递，则会更好。
@AAA: The process will be like so:
1) The user upload a file, say test.exe.
2) When it received by server, you extract the extension and store it in database with the name of file, so you can know witch file have type extension.
3) When a user request a file , you query both file extension and its name, assemble them and finally send it to user.
Note:
You may have duplicate name problem, it will be better if you generate a fixed length of random string and past it with file name in begging of file name as example.
请注意，这是在“PHP Upload”下列出的，我相信他正在谈论远程执行。如果是这种情况，它们应该都是安全的。我通常阻止的内容列表位于此处的 htaccess 列表中
Noting that this is listed under 'PHP Upload", I believe he's talking about remote exeuction. If that is the case they should all be safe. The usual list of things I block is in this htaccess list here