[Resolved] user uploads file, risks?

bliss322

not an actual problem i'm having, more a general question.

if i have a site with the cliche "submit your photo", what risks do i have if that photo contains a virus?

what are my options in protecting my server?

stolzyboy

you can always use $_FILES['type'] to check to make sure the file is an image, this will return the mime-type so you can make sure the file isn't a .dll or .exe or something like that

bliss322

okay.

but aren't there viruses that actually get imbedded in image files or other filetypes, like .doc, and they don't necessarily change the filetype?

or am i wrong here?

dalecosp

Yeah, viruses can have faked MIME headers.

Run 'Nix, no virii over there.

Of course, then what about text files with a little Perl or PHP in them? Y'know, mail calls to /etc/passwd, etc...

stolzyboy

yes that is true, but you are never gonna be 100% sure what it is, but take as many steps as you can, there aren't too many viruses that use images or the like, most use some form of text file or compiled code, so if you are only wanting photos, you shouldn't have to worry too much about viruses, and yes what dale said is true, the normal viruses that users see are windoze targeted, if your site is on *nix, you don't have to worry too much anyway

bliss322

"Run 'Nix, no virii over there. "

what?

bliss322

"the normal viruses that users see are windoze targeted, if your site is on *nix, you don't have to worry too much anyway"

now i understand.

well, i'm already on *nix, so alright then