php简单上传demo

php简单的上传demo,判断了文件类型,按时间去创建文件夹,生成了随机文件名
如果把文件类型判断去掉,就是一个简单的上传漏洞,可以用来上传php文件,来执行

<?php 
$res = [];
if (!empty($_FILES['file'])) {
    $suffix_name = strrchr($_FILES['file']['name'],'.');
    $suffix_name = strtolower($suffix_name);
    if (!($suffix_name == '.png' || $suffix_name == '.jpeg' || $suffix_name == '.jpg' || $suffix_name == '.gif' || $suffix_name == '.bmp')) {
        $res['msg'] = '上传类型不合法';
        echo json_encode($res);exit();
    }
    $rand_num = md5(time().rand(0,10));
    $name = $rand_num.$suffix_name;
    $path = $_SERVER['DOCUMENT_ROOT'].'/uploads/'.date('Y').'/'.date('m').'/'.date('d').'/img/';
    if(!is_dir($path)){
        $dir_res = mkdir($path,0777,true);
        if (!$dir_res) {
            $res['msg'] = '文件夹不存在,创建失败';
            echo json_encode($res);exit();
        }
    }
    $path .= $name; 
    if(move_uploaded_file($_FILES['file']['tmp_name'],$path)){
        $res['path'] = $path;
    }else{
        $res['msg'] = '移动临时文件到目录失败,参数1为'.$_FILES['file']['tmp_name'].',参数2为'.$path;
        echo json_encode($res);exit();
    }
}else{
    $res['msg'] = '上传文件为空,正确的上传文件name值为file';
}
echo json_encode($res);
Last modification:August 7th, 2019 at 09:49 am
If you think my article is useful to you, please feel free to appreciate

Leave a Comment

简爱博客