Special Characters in $_FILES['tmp_name'] ?

Not for 'how-to' coding questions but PHP theory instead, this forum is here for those of us who wish to learn about design aspects of programming with PHP.

Moderator: General Moderators

Post Reply
eclavito
Forum Newbie
Posts: 5
Joined: Wed Jun 04, 2008 8:22 pm

Special Characters in $_FILES['tmp_name'] ?

Post by eclavito »

Hi.

I have a question about how php generates the tmp_name in $_FILES. Is it possible that special characters exists in $_FILES['tmp_name']?

Example : AWs?Q.txt - is this possible?

Thank you and God Bless.
User avatar
Chris Corbyn
Breakbeat Nuttzer
Posts: 13098
Joined: Wed Mar 24, 2004 7:57 am
Location: Melbourne, Australia

Re: Special Characters in $_FILES['tmp_name'] ?

Post by Chris Corbyn »

I'm not sure, but I wouldn't code on the assumption that it won't. You should only ever use that path once (to move the file somewhere else -- and rename it).
User avatar
Benjamin
Site Administrator
Posts: 6935
Joined: Sun May 19, 2002 10:24 pm

Re: Special Characters in $_FILES['tmp_name'] ?

Post by Benjamin »

$_FILES['tmp_name'] is set by PHP when a file is uploaded so I'm not sure why your asking this. $_FILES['tmp_name'] is also a string, so yes it can contain anything. As to whether or not it's a valid file name or not, that's OS dependant.

See:
http://www.linux.com/base/ldp/howto/Sec ... names.html
eclavito
Forum Newbie
Posts: 5
Joined: Wed Jun 04, 2008 8:22 pm

Re: Special Characters in $_FILES['tmp_name'] ?

Post by eclavito »

To: astions

As you've said, $_FILES['tmp_name'] is set by PHP when file is uploaded. My question is, Is is possible that PHP sets the tmp_name with special characters like "?", "/", etc.?

I am asking this question because I am using $_FILES['tmp_name'] as a unique identifier for the uploaded files in the database. If PHP sets $_FILES['tmp_name'] with special characters, it will cause possible flaw/s in my system.

I might consider chris' advice.

Thanks for your reply. God Bless.

Please let me know your opinions about this.
User avatar
Eran
DevNet Master
Posts: 3549
Joined: Fri Jan 18, 2008 12:36 am
Location: Israel, ME

Re: Special Characters in $_FILES['tmp_name'] ?

Post by Eran »

alternatively you can hash it using md5 or something similar to recieve a unique identifier that is alpha-numeric.
User avatar
Benjamin
Site Administrator
Posts: 6935
Joined: Sun May 19, 2002 10:24 pm

Re: Special Characters in $_FILES['tmp_name'] ?

Post by Benjamin »

No there won't be special characters in it.
eclavito
Forum Newbie
Posts: 5
Joined: Wed Jun 04, 2008 8:22 pm

Re: Special Characters in $_FILES['tmp_name'] ?

Post by eclavito »

To : astions

do you have any references? or website that I can refer to?

Thank you very much.
User avatar
Benjamin
Site Administrator
Posts: 6935
Joined: Sun May 19, 2002 10:24 pm

Re: Special Characters in $_FILES['tmp_name'] ?

Post by Benjamin »

No I don't. I tried to find out where it was created in the PHP source code but wasn't able to locate it. I have never seen anything other than letters, numbers, underscores and dashes though. The temporary name may be returned by the operating system.
eclavito
Forum Newbie
Posts: 5
Joined: Wed Jun 04, 2008 8:22 pm

Re: Special Characters in $_FILES['tmp_name'] ?

Post by eclavito »

astions,

Thank you very much for your help. :D
User avatar
Chris Corbyn
Breakbeat Nuttzer
Posts: 13098
Joined: Wed Mar 24, 2004 7:57 am
Location: Melbourne, Australia

Re: Special Characters in $_FILES['tmp_name'] ?

Post by Chris Corbyn »

Really don't rely on $_FILES['tmp_name'] being unique. It's not unique ;)
User avatar
Benjamin
Site Administrator
Posts: 6935
Joined: Sun May 19, 2002 10:24 pm

Re: Special Characters in $_FILES['tmp_name'] ?

Post by Benjamin »

Chris is right, it's not designed for that purpose. You can use the uniqid function.
eclavito
Forum Newbie
Posts: 5
Joined: Wed Jun 04, 2008 8:22 pm

Re: Special Characters in $_FILES['tmp_name'] ?

Post by eclavito »

yes. i think i should try other approach.
Post Reply