Thread: PHP extracting rar files.
View Single Post
  #4 (permalink)  
Old 03-02-08, 09:37 AM
Nico's Avatar
Nico Nico is offline
Community Leader
  
Join Date: Sep 2005
Location: Spain
Posts: 8,074
Thanks: 11
Thanked 88 Times in 83 Posts
Another thought is, are you sure they extracted the file? Or could they have fooled your uploader by giving the uploaded php file a fake MIME type?

In your script, are you relying on the type value in $_FILES['file']['type'] to verify the files?
Reply With Quote