The problem of not being able to upload files caused by the is_uploaded_file function_PHP tutorial

Cause:

In a project, I received feedback from users that all of their customers could not upload files and all returned failures. After investigation, it was found that the is_uploaded_file function in PHP was causing trouble.

Detailed analysis:

Under normal circumstances, when uploading files through PHP, you need to use the is_uploaded_file function to determine whether the file is uploaded through HTTP POST. This can be used Ensure that malicious users cannot trick scripts into accessing otherwise inaccessible files, such as /etc/passwd.
The problem encountered this time is that the tmp_name that should have been C:/WINDOWS/Temp/php99.tmp has become C://WINDOWS //Temp//php99.tmp, resulting in is_uploaded_file The function returns incorrect information.

Processing method:

After adding the following code, the problem is solved.
$file['tmp_name'] = str_replace('////', '//', $file['tmp_name']);
Note that the actual string "////" is two A /, the other two are used to express escape.

In-depth study:

Why does this happen in a specific environment of dictation? Let’s take a look at the following analysis:
; Magic quotes for incoming GET /POST/Cookie data.
magic_quotes_gpc = On
In the default configuration of PHP, magic_quotes_gpc is On, and the PHP environment with the magic_quotes_gpc parameter turned on will automatically add addslashes effects to GET/POST /Cookie. Note that addslashes will not be added to $_FILES.
When magic_quotes_gpc is Off, a problem occurs because the addslashes function is added to the $_FILES array. This problem will also occur in PHP environments where magic_quotes_gpc is Off.

By the way, the MooPHP code on SVN has fixed this problem.

is_uploaded_file function analysis:

Determine whether the file is uploaded through HTTP POST
bool is_uploaded_file ( string $filename )
If filename is given Returns TRUE if the file was uploaded via HTTP POST. This can be used to ensure that a malicious user cannot trick a script into accessing otherwise inaccessible files, such as /etc/passwd. This check is particularly important if the uploaded file is likely to cause its content to be displayed to the user or other users of the system.

In order for the is_uploaded_file() function to work properly, a variable similar to $_FILES['userfile']['tmp_name'] must be specified, and in the file name uploaded from the client $_FILES['userfile ']['name'] does not work properly.