PHP & MySQL® Web Development All-in-One Desk Reference for Dummies®

4.3. Uploading Files without Compromising the Filesystem

Most applications don't need to upload files. These applications are more secure if you do not allow file uploaded. You can prevent file uploading with the file_uploads setting in your php.ini file. The setting is on by default, as follows:

file_uploads = On

Change the setting to Off to prevent any file uploads in PHP scripts.

Some applications need to let users upload files. (Book VI, Chapter 1 shows a script that allows a user to upload a file.) Unfortunately, this requirement also creates the potential for serious security problems. Malicious users can

• Launch Denial of Service (DoS) attacks

• Overwrite existing files

• Place malicious code on the server for later use

Because of the open nature of Web applications, you can't completely secure file upload functionality within your application, but you can mitigate the dangers.

4.3.1. Avoiding DoS attacks on the filesystem

File uploads create the potential for DoS attacks because malicious users can upload extremely large files and use all available resources in the filesystem in the process. Uploading large files can effectively bring the server down by preventing it from writing temporary files or virtual memory swap files. You can limit file sizes in php.ini, but doing so doesn't prevent a scripted attack that tries to upload hundreds of 2MB files every second.

You should certainly place limits on file sizes in php.ini (refer to Chapter 3 in this minibook for more information ...