Checking file name of uploaded jpeg

bunner_bob

Does anyone know of a good procedure to check the file name of an uploaded jpeg, to make sure it's as "legal" as possible? Maybe an existing preg_match to run on the filename?

Right now I'm using strstr() to check if the filename contains ".jpg" or ".JPG", and does NOT contain a space character.

What else should I check for? I imagine there's quite a lot that could mess things up, especially since I'm retrieving the images into a javascript array, and javascript can be kinda picky.

Thanks!

natstar

Heya, first i would check whether the file is an actual jpeg (not just a file with jpg ext) by doing this:

$img_arr = getimagesize($fname);

where $fname is $_FILES['img']['tmp_name'] and 'img' is the HTML input field name used to upload the file..

If $img_arr[2] == IMG_JPEG then the file is a jpeg.

If you must check for a jpeg ext then, just do ereg(".jpg$/i", $fname), if it return true then it has jpg or JPG extension

hope it helps,
Natalia

Mce

$filtyp = $HTTP_POST_FILES['NAMEOFINPUTFIELDFROMFORM']['type'];
switch($filtyp) {
    case "image/jpeg": break;
    case "image/pjpeg": break;
    case "image/png": echo "We don't like .png files at this site please upload .jpg"; break;
    case "image/gif": echo ".gif's are patent encumbered sillyness please upload another fotmat file"; break;
    default: echo "Bad file type"; break;
}

Hope this helps

-Mce

bunner_bob

I should have been more specific.

I'm already checking file type, file size >0, and making sure file is an uploaded file (as opposed to a file already in the directory), and my little strstr() routine does an adequate job of catching files that don't have .jpg or .JPG in their names.

I'm wondering about filenames specifically. The front-end page for my site builds a javascript array of these filenames, and it seemed to have a problem with a space character in a filename. I can imagine there are a lot of bad characters like ([]{}/"'#?) that it wouldn't do to have in a filename. I'm wondering:

1 - any suggestions as to how to limit filenames? Alpha and numbers, hyphen, underscore ONLY? Is there any agreement as to what constitutes acceptable characters in a filename?

2 - any "preexisting" regexps for checking this?

natstar

If I remember correctly, JS shouldnt be having probs with space in a properly formed array so long as you use double quotes for the values so I take it your filename dilemma is because you're using PHP on Windows and when you try to create the files at the server side you dont want file creation errors due to illegal filenames...

As for 1) I am not aware of any convention but I would allow [a-z][A-Z][0-1]_$~ and space should be OK so long as it is between non space chars, using trim() should help you there...

For 2) I dont know about a precooked one but it shouldnt be hard to find or cook your own using the info in http://www.php.net/manual/en/ref.regex.php