Return to Answer

enter image description here

enter image description here

screenshot of wider decision tree _{screenshot captured from source: Your code sucks, let's fix it - By Rafael Dohms at 15:17}

enter image description here _{screenshot captured from source: Your code sucks, let's fix it - By Rafael Dohms at 15:28}

My initial thought is to ensure that the uploaded file is not an executable file or a file that may be run as a separate script- e.g. PHP or some other language the server may handle. The Mime type checking should handle that for the most part, though be aware that mime types can be spoofed so it is advisable to "scan the first couple of bytes to see if the files contain the relevant image header signatures - all relevant image formats have these." ¹

• check the permissions on the file after it is uploaded to ensure anything that shouldn’t be executed cannot be executed - perhaps use is_executable(), fileperms and chmod
• like you say: "move images folder out of public_html (root) folder."- Ensure that any uploaded files are not stored in a web accessible directory unless that is your desire. This may lead to needing a (PHP/other) script or web server module to read files.

My initial thought is to ensure that the uploaded file is not an executable file or a file that may be run as a separate script- e.g. PHP or some other language the server may handle. The Mime type checking from finfo::file() should handle that.

• check that a GD function like imagecreatefromgif() , imagecreatefromjpeg() , etc. does not return FALSE
• check the permissions on the file after it is uploaded to ensure anything that shouldn’t be executed cannot be executed - perhaps use is_executable(), fileperms and chmod
• like you say: "move images folder out of public_html (root) folder."- Ensure that any uploaded files are not stored in a web accessible directory unless that is your desire. This may lead to needing a (PHP/other) script or web server module to read files.

My initial thought is to ensure that the uploaded file is not an executable file or a file that may be run as a separate script- e.g. PHP or some other language the server may handle. The Mime type checking should handle that for the most part. You could also :

My initial thought is to ensure that the uploaded file is not an executable file or a file that may be run as a separate script- e.g. PHP or some other language the server may handle. The Mime type checking should handle that for the most part, though be aware that mime types can be spoofed so it is advisable to "scan the first couple of bytes to see if the files contain the relevant image header signatures - all relevant image formats have these." ¹

You could also :