当前位置：文江博客话题详情

使用 PHP 上传音频文件

发布于 2024-11-08 02:34:28 字数 62 浏览 0 评论 0原文

我需要建立一个允许注册用户上传音频文件的网站。我想知道是否有关于安全的防弹实践。该网站是用 PHP 构建的

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

微凉 2024-11-15 02:34:28

检查上传文件的 mime 类型

mp3 -> audio/mpeg

更多信息请参见：http://www.w3schools.com/media/media_mimeref。 ASP

Check mime type of uploading file

mp3 -> audio/mpeg

More here: http://www.w3schools.com/media/media_mimeref.asp

回复收藏 0 原文

十秒萌定你 2024-11-15 02:34:28

您需要仔细检查文件类型。这意味着不只是在文件名上执行子字符串来获取扩展名。扩展名并不是文件实际内容的具体指示。

正如 Danzan 所说，您需要使用如下代码来检查文件的 MIME 类型：

if ($_FILES["audioUpload"]["type"] == "audio/mpeg") {
//proceed with upload procedure
} else {
echo "Only mp3's are allowed to be uploaded.";
}

这可以将用户将恶意 PHP 代码上传到您的上传目录的机会基本上降低到零。

You will want to check the file type carefully. This means not just doing a substring on the file name to get the extension. The extension is not a concrete indicator of what the file actually is.

As Danzan said, you will want to check the MIME type of the file, using some code like this:

if ($_FILES["audioUpload"]["type"] == "audio/mpeg") {
//proceed with upload procedure
} else {
echo "Only mp3's are allowed to be uploaded.";
}

This reduces the chances of a user uploading, say, malicious PHP code into your upload directory to basically zero.

回复收藏 0 原文

痕至 2024-11-15 02:34:28

通过 getimagesize、fileinfo 扩展和 mime_content_type 函数的组合提供防弹文件类型检查（Nette Framework 属性）：

// $file is absolute path to the uploaded file
$info = @getimagesize($file); // @ - files smaller than 12 bytes causes read error
if (isset($info['mime'])) {
   return $info['mime'];
} elseif (extension_loaded('fileinfo')) {
   $type = preg_replace('#[\s;].*$#', '', finfo_file(finfo_open(FILEINFO_MIME), $file));
} elseif (function_exists('mime_content_type')) {
   $type = mime_content_type($file);
}
return isset($type) && preg_match('#^\S+/\S+$#', $type)
    ? $type 
    : 'application/octet-stream';

您不能信任来自客户端的任何数据，因为它们很容易被伪造。

Bullet-proof file type check is provided via combination of getimagesize, fileinfo extension and mime_content_type function (Nette Framework property):

// $file is absolute path to the uploaded file
$info = @getimagesize($file); // @ - files smaller than 12 bytes causes read error
if (isset($info['mime'])) {
   return $info['mime'];
} elseif (extension_loaded('fileinfo')) {
   $type = preg_replace('#[\s;].*$#', '', finfo_file(finfo_open(FILEINFO_MIME), $file));
} elseif (function_exists('mime_content_type')) {
   $type = mime_content_type($file);
}
return isset($type) && preg_match('#^\S+/\S+$#', $type)
    ? $type 
    : 'application/octet-stream';

You can not trust any data coming from the client, because they can be easily forged.

回复收藏 0 原文