AAuuggh please help - validate file upload field

bbeban

Hello, I am pulling my hair out (again) because i want to validate the name of a file when it is put into the file upload field of my form -- checking the name for bad characters and disallowing the upload if any are present. I have been trying to do this using Javascript but even just that is not proving to be secure enough: I can get an alert if bad characters are present, but then 9 times out of 10 the user can just hit submit again and off it goes.

Does anyone know of a script that works for this? I only want to allow alphanumeric plus underscores, hyphens and periods. Seems like it should be so simple, but the fact that no one solution seems to exist is making me nuts. Please help!

Thanks,

Bob

LordShryku

Search the forums. A simple preg_match statement will do it for you. Javascript will never be secure, since it can be turned off.

bbeban

Hi, I did search the forums pretty extensively before I asked. Now I am looking into preg_match (something I did not previously know about). Please forgive me, I am very inexperienced. Can you give me a little push? How would I begin using preg_match to identify if the file name has bad characters and preventing download if that is the case?

Thanks for your response and your patience --

LordShryku

Look at This post and take a look at the [man]preg_match[/man] manual page. Those two should give you everything you need to get this done. I could tell you exactly how to do it, but then you wouldn't really be learning it...

bbeban

OK, I have spent a little time with this and I'm coming up baffled. Can anyone nudge me along?

This:

<?php
if (isset($submit) && (!preg_match("/^{[A-Za-z0-9-_.} :\]+$/", $file))) {
echo "Sorry, file name contains unacceptable characters. Please re-name file and try again.";
die();
}
?>

Does not do anything. A file name such as !@#%$8.doc gets uploaded without incident. What am I missing?

bbeban

P.S. I did define $file in the code above that snippet, thusly:

$file = $HTTP_POST_VARS['file'];

coditoergosum

$file = $HTTP_POST_VARS['file']; isn't going to work.

Read this: http://php.net/features.file-upload

Does anybody actually read the PHP manual anymore? That's about the third time in the past week I've posted that link.

bbeban

Yes, I do read the manual, though as a newbie I often find it difficult to understand without a little extra explanation or a tutorial, which I often can find on Google. I am neither a moron nor a lazy slob, 2 types of folks for whom your comment seems to be reserved.

In this case, I have tried Google, tried the manual, still having trouble. I appreciate your posting help for me GREATLY, please believe me, but of course telling me what does not work without any suggestion of what does pretty much ends me right where I was.

Incidentally, I am using Pure PHP Upload 2.0, a Dreamweaver extension, for the upload -- and it requires $HTTP_POST_VARS in order to work at all, which is the only reason it appears in my code. Everything works fine, I just can't seem to validate the characters in the uploaded file name.

The following other attempts do not work either:

$file = $_POST['file'];

$file = $_FILES['file']['name'];

Can coditoergosum, or anyone, give me another nudge along on this one? Sincere thanks if you can/will.

bbeban

Call off the hunt, this is working for me now (I added a hidden field based on a reply I saw elsewhere on the forum):

<?php
$file = str_replace(" ","",$FILES['file']['name']);
$pattern = "/^{[a-zA-Z0-9_.-]+$/";}
if(isset($POST['submitted']) && $POST['submitted'] == "yes" && (!preg_match($pattern, $file))) {
echo "Sorry, file name contains unacceptable characters. Please re-name file and <a href=\"javascript:history.back();\">try again</a>.";
exit();
}
else

?>

Sincere thanks to both of you who replied. All of your input was helpful, my comments to the contrary notwithstanding.