Re: uploading files with a single quote in the filename

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Wed, 2005-02-23 at 18:45, neil@xxxxxxxxxxx wrote:
> Hi Brett
> 
> My form is effectively identical to yours
> <form enctype="multipart/form-data" action="/uploadfiles.php" method="post">
> <b>Upload a file:</b> <input name="userfile" type="file" size="100">
> 
> No the first part of the file name is just dropped and the file with the
> truncated name is saved in the correct place.
> 
> But with it escaping the quote do you mean that you end up with a file with
> \ in it? That would be an illegal filename.
> 
> Neil
> 

Yep that is exactly what I mean.  Not sure if \it is illegal on a linux
box although unusual    The directory separator is /.  I am going to be
looking at the code soon to try and get a handle on it.  At this point I
do not know where it is coming from but I should be able to examine the
variables that get sent to the server and see where in the
browser/php/OS interaction the thing is occurring. 

I'll let you know.  I like allowing users to name files as they will and
test all my scripts that handle file names to make sure the handle
spaces well but should probably check for a few boneheaded things like
that.  A little javascript goes a  long way in these sort of situations
:)

Bret

-- 
PHP General Mailing List (http://www.php.net/)
To unsubscribe, visit: http://www.php.net/unsub.php



[Index of Archives]     [PHP Home]     [Apache Users]     [PHP on Windows]     [Kernel Newbies]     [PHP Install]     [PHP Classes]     [Pear]     [Postgresql]     [Postgresql PHP]     [PHP on Windows]     [PHP Database Programming]     [PHP SOAP]

  Powered by Linux