Image Posting

[neox_blueline]

I have a slight problem, I am displaying avatars for people who upload them, but people are putting HTML/PHP code inside the .jpg instead of an actual image, and it is executing on the page. When they upload I am checking to see if its a jpeg, and they are, so how could I stop this?

Thanks alot..

// Update:

I believe that I have fixed this, I put more strict parameters on uploading, but if anyone else has had this problem, feel free to provide their input.

[rachel2004]

There are probably a few ways of doing this, but the strip_tags() function would probably be enough for your situation.

http://www.php.net/manual/en/function.strip-tags.php

But, since you're describing the problem occuring during a file upload, check this out as well:

http://www.php.net/manual/en/ref.mime-magic.php

You may want to post your workaround when you write again so the rest of us can benefit from what you've tried.