我不知道这是否会发生，但我会尝试。

在过去的一个小时里，我研究了图片上传的安全性。我了解到有很多功能可以测试上传。

在我的项目中，我需要确保上传图片的安全。它也可能非常多，并且可能需要大量带宽，因此购买 API 不是一种选择。

所以我决定获取一个完整的 PHP 脚本来真正安全地上传图片。我也认为这对很多人都有帮助，因为很难找到真正安全的。但是我不是php方面的专家，所以添加一些功能对我来说真的很头疼，所以我会请求这个社区帮助创建一个真正安全的图像上传的完整脚本。

关于这方面的真正伟大的话题就在这里(但是，他们只是告诉我们需要什么来完成这个技巧，而不是如何做到这一点，正如我所说，我不是 PHP 的高手，所以我无法做到这一切我自己):
PHP image upload security check list
https://security.stackexchange.com/questions/32852/risks-of-a-php-image-upload-form

总之，他们告诉我们这是安全图像上传所需要的(我将引用上述页面):

• Disable PHP from running inside the upload folder using .httaccess.
• Do not allow upload if the file name contains string "php".
• Allow only extensions: jpg,jpeg,gif and png.
• Allow only image file type.
• Disallow image with two file type.
• Change the image name. Upload to a sub-directory not root directory.

Also:

• Re-process the image using GD (or Imagick) and save the processed image. All others are just fun boring for hackers"
• As rr pointed out, use move_uploaded_file() for any upload"
• By the way, you'd want to be very restrictive about your upload folder. Those places are one of the dark corners where many exploits
  happen. This is valid for any type of upload and any programming
  language/server. Check
  https://www.owasp.org/index.php/Unrestricted_File_Upload
• Level 1: Check the extension (extension file ends with)
• Level 2: Check the MIME type ($file_info = getimagesize($_FILES['image_file']; $file_mime = $file_info['mime'];)
• Level 3: Read first 100 bytes and check if they have any bytes in the following range: ASCII 0-8, 12-31 (decimal).
• Level 4: Check for magic numbers in the header (first 10-20 bytes of the file). You can find some of the files header bytes from here:
  http://en.wikipedia.org/wiki/Magic_number_%28programming%29#Examples
• You might want to run "is_uploaded_file" on the $_FILES['my_files']['tmp_name'] as well. See
  http://php.net/manual/en/function.is-uploaded-file.php

function uploadFile ($file_field = null, $check_image = false, $random_name = false) {

//Config Section    
//Set file upload path
$path = 'uploads/'; //with trailing slash
//Set max file size in bytes
$max_size = 1000000;
//Set default file extension whitelist
$whitelist_ext = array('jpeg','jpg','png','gif');
//Set default file type whitelist
$whitelist_type = array('image/jpeg', 'image/jpg', 'image/png','image/gif');

//The Validation
// Create an array to hold any output
$out = array('error'=>null);

if (!$file_field) {
  $out['error'][] = "Please specify a valid form field name";           
}

if (!$path) {
  $out['error'][] = "Please specify a valid upload path";               
}

if (count($out['error'])>0) {
  return $out;
}

//Make sure that there is a file
if((!empty($_FILES[$file_field])) && ($_FILES[$file_field]['error'] == 0)) {

// Get filename
$file_info = pathinfo($_FILES[$file_field]['name']);
$name = $file_info['filename'];
$ext = $file_info['extension'];

//Check file has the right extension           
if (!in_array($ext, $whitelist_ext)) {
  $out['error'][] = "Invalid file Extension";
}

//Check that the file is of the right type
if (!in_array($_FILES[$file_field]["type"], $whitelist_type)) {
  $out['error'][] = "Invalid file Type";
}

//Check that the file is not too big
if ($_FILES[$file_field]["size"] > $max_size) {
  $out['error'][] = "File is too big";
}

//If $check image is set as true
if ($check_image) {
  if (!getimagesize($_FILES[$file_field]['tmp_name'])) {
    $out['error'][] = "Uploaded file is not a valid image";
  }
}

//Create full filename including path
if ($random_name) {
  // Generate random filename
  $tmp = str_replace(array('.',' '), array('',''), microtime());

  if (!$tmp || $tmp == '') {
    $out['error'][] = "File must have a name";
  }     
  $newname = $tmp.'.'.$ext;                                
} else {
    $newname = $name.'.'.$ext;
}

//Check if file already exists on server
if (file_exists($path.$newname)) {
  $out['error'][] = "A file with this name already exists";
}

if (count($out['error'])>0) {
  //The file has not correctly validated
  return $out;
} 

if (move_uploaded_file($_FILES[$file_field]['tmp_name'], $path.$newname)) {
  //Success
  $out['filepath'] = $path;
  $out['filename'] = $newname;
  return $out;
} else {
  $out['error'][] = "Server Error!";
}

 } else {
  $out['error'][] = "No file uploaded";
  return $out;
 }      
}


if (isset($_POST['submit'])) {
 $file = uploadFile('file', true, true);
 if (is_array($file['error'])) {
  $message = '';
  foreach ($file['error'] as $msg) {
  $message .= '<p>'.$msg.'</p>';    
 }
} else {
 $message = "File uploaded successfully".$newname;
}
 echo $message;
}

<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post" enctype="multipart/form-data" name="form1" id="form1">
<input name="file" type="file" id="imagee" />
<input name="submit" type="submit" value="Upload" />
</form>

最佳答案

当您开始处理安全图像上传脚本时，需要考虑很多事情。现在我远不是这方面的专家，但过去曾有人要求我开发这个。我将介绍我在这里经历的整个过程，以便您可以跟随。为此，我将从一个非常基本的 html 表单和处理文件的 php 脚本开始。
HTML表单:

<form name="upload" action="upload.php" method="POST" enctype="multipart/form-data">
    Select image to upload: <input type="file" name="image">
    <input type="submit" name="upload" value="upload">
</form>

<?php
$uploaddir = 'uploads/';

$uploadfile = $uploaddir . basename($_FILES['image']['name']);

if (move_uploaded_file($_FILES['image']['tmp_name'], $uploadfile)) {
    echo "Image succesfully uploaded.";
} else {
    echo "Image uploading failed.";
}
?> 

<?php
if($_FILES['image']['type'] != "image/png") {
    echo "Only PNG images are allowed!";
    exit;
}

$uploaddir = 'uploads/';

$uploadfile = $uploaddir . basename($_FILES['image']['name']);

if (move_uploaded_file($_FILES['image']['tmp_name'], $uploadfile)) {
    echo "Image succesfully uploaded.";
} else {
    echo "Image uploading failed.";
}
?>

<?php
$verifyimg = getimagesize($_FILES['image']['tmp_name']);

if($verifyimg['mime'] != 'image/png') {
    echo "Only PNG images are allowed!";
    exit;
}

$uploaddir = 'uploads/';

$uploadfile = $uploaddir . basename($_FILES['image']['name']);

if (move_uploaded_file($_FILES['image']['tmp_name'], $uploadfile)) {
    echo "Image succesfully uploaded.";
} else {
    echo "Image uploading failed.";
}
?>

order deny,allow
deny from all
allow from 127.0.0.1

<?php
$uploaddir = 'uploads/';
$name = $_GET['name']; // Assuming the file name is in the URL for this example
readfile($uploaddir.$name);
?>

<?php
if(isset($_COOKIE['lang'])) {
   $lang = $_COOKIE['lang'];
} elseif (isset($_GET['lang'])) {
   $lang = $_GET['lang'];
} else {
   $lang = 'english';
}

include("language/$lang.php");
?>

CREATE TABLE `uploads` (
    `id` INT(11) NOT NULL AUTO_INCREMENT,
    `name` VARCHAR(64) NOT NULL,
    `original_name` VARCHAR(64) NOT NULL,
    `mime_type` VARCHAR(20) NOT NULL,
    PRIMARY KEY (`id`)
) ENGINE=InnoDB AUTO_INCREMENT=0 DEFAULT CHARSET=utf8;

<?php

if(!empty($_POST['upload']) && !empty($_FILES['image']) && $_FILES['image']['error'] == 0)) {

    $uploaddir = 'uploads/';

    /* Generates random filename and extension */
    function tempnam_sfx($path, $suffix){
        do {
            $file = $path."/".mt_rand().$suffix;
            $fp = @fopen($file, 'x');
        }
        while(!$fp);

        fclose($fp);
        return $file;
    }

    /* Process image with GD library */
    $verifyimg = getimagesize($_FILES['image']['tmp_name']);

    /* Make sure the MIME type is an image */
    $pattern = "#^(image/)[^\s\n<]+$#i";

    if(!preg_match($pattern, $verifyimg['mime']){
        die("Only image files are allowed!");
    }

    /* Rename both the image and the extension */
    $uploadfile = tempnam_sfx($uploaddir, ".tmp");

    /* Upload the file to a secure directory with the new name and extension */
    if (move_uploaded_file($_FILES['image']['tmp_name'], $uploadfile)) {

        /* Setup a database connection with PDO */
        $dbhost = "localhost";
        $dbuser = "";
        $dbpass = "";
        $dbname = "";
        
        // Set DSN
        $dsn = 'mysql:host='.$dbhost.';dbname='.$dbname;

        // Set options
        $options = array(
            PDO::ATTR_PERSISTENT    => true,
            PDO::ATTR_ERRMODE       => PDO::ERRMODE_EXCEPTION
        );

        try {
            $db = new PDO($dsn, $dbuser, $dbpass, $options);
        }
        catch(PDOException $e){
            die("Error!: " . $e->getMessage());
        }

        /* Setup query */
        $query = 'INSERT INTO uploads (name, original_name, mime_type) VALUES (:name, :oriname, :mime)';

        /* Prepare query */
        $db->prepare($query);

        /* Bind parameters */
        $db->bindParam(':name', basename($uploadfile));
        $db->bindParam(':oriname', basename($_FILES['image']['name']));
        $db->bindParam(':mime', $_FILES['image']['type']);

        /* Execute query */
        try {
            $db->execute();
        }
        catch(PDOException $e){
            // Remove the uploaded file
            unlink($uploadfile);

            die("Error!: " . $e->getMessage());
        }
    } else {
        die("Image upload failed!");
    }
}
?>

<?php

$uploaddir = 'uploads/';
$id = 1;

/* Setup a database connection with PDO */
$dbhost = "localhost";
$dbuser = "";
$dbpass = "";
$dbname = "";

// Set DSN
$dsn = 'mysql:host='.$dbhost.';dbname='.$dbname;

// Set options
$options = array(
    PDO::ATTR_PERSISTENT    => true,
    PDO::ATTR_ERRMODE       => PDO::ERRMODE_EXCEPTION
);

try {
    $db = new PDO($dsn, $dbuser, $dbpass, $options);
}
catch(PDOException $e){
    die("Error!: " . $e->getMessage());
}

/* Setup query */
$query = 'SELECT name, original_name, mime_type FROM uploads WHERE id=:id';

/* Prepare query */
$db->prepare($query);

/* Bind parameters */
$db->bindParam(':id', $id);

/* Execute query */
try {
    $db->execute();
    $result = $db->fetch(PDO::FETCH_ASSOC);
}
catch(PDOException $e){
    die("Error!: " . $e->getMessage());
}

/* Get the original filename */
$newfile = $result['original_name'];

/* Send headers and file to visitor */
header('Content-Description: File Transfer');
header('Content-Disposition: attachment; filename='.basename($newfile));
header('Expires: 0');
header('Cache-Control: must-revalidate');
header('Pragma: public');
header('Content-Length: ' . filesize($uploaddir.$result['name']));
header("Content-Type: " . $result['mime_type']);
readfile($uploaddir.$result['name']);
?>

关于php - 完整的安全图像上传脚本，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/38509334/