Posted by Sanders Kaufman on 07/25/07 06:27

FFMG wrote:
> Hi,
>
> My users can upload images in a folder on my system.
> What minimum attribute should I give the created, (@fopen($new_file,
> 'wb');), files and folder?
>
> I limit the extension of files, (images), but I want to prevent them
> from executing any code on the server.
>
> What attributes would you suggest?


Just a note about this.
I found out a few years ago that you also should strip header
information out of GIF images. You can put PHP code in there, and it
executed when the gif is displayed.

Freaky.

[Back to original message]