php determines whether image exists-PHP Problem-php.cn

In our daily development, we often need to judge whether the picture exists. If it exists, it will be displayed. If it does not exist, the default picture will be displayed. So how do we judge?

php determines whether image exists

##getimagesize() function(Recommended learning:PHP programming from entry to proficiency)## The #getimagesize function is not part of the GD extension and can be used by standard installed PHP. You can first take a look at the document description of this function:

http://php.net/manual/zh/function.getimagesize.php

Copy after login

If the specified file is not a valid image, false

will be returned. There is also a field indicating the document type in the returned data. If you don't use it to get the size of the file but use it to determine whether the uploaded file is an image file, it seems to be a very good solution. Of course, this requires shielding possible warnings. For example, the code reads like this:

Copy after login

But if you just do such verification, then unfortunately, you have successfully planted a webshell vulnerability in the code.

To analyze this problem, let’s first take a look at the prototype of this function:

static void php_getimagesize_from_stream(php_stream *stream, zval **info, INTERNAL_FUNCTION_PARAMETERS){ ... itype = php_getimagetype(stream, NULL TSRMLS_CC); switch( itype) { ... } ... }static void php_getimagesize_from_any(INTERNAL_FUNCTION_PARAMETERS, int mode) { ... php_getimagesize_from_stream(stream, info, INTERNAL_FUNCTION_PARAM_PASSTHRU); php_stream_close(stream); } PHP_FUNCTION(getimagesize) { php_getimagesize_from_any(INTERNAL_FUNCTION_PARAM_PASSTHRU, FROM_PATH); }

Copy after login

Limited space has hidden some details. Now we know two things from the above code. That’s enough:
The final processing function is php_getimagesize_from_stream

The function responsible for determining the file type is php_getimagetype

Let’s take a look at the implementation of php_getimagetype:

PHPAPI int php_getimagetype(php_stream * stream, char *filetype TSRMLS_DC){ ... if (!memcmp(filetype, php_sig_gif, 3)) { return IMAGE_FILETYPE_GIF; } else if (!memcmp(filetype, php_sig_jpg, 3)) { return IMAGE_FILETYPE_JPEG; } else if (!memcmp(filetype, php_sig_png, 3)) { ... } }

Copy after login

The above is the detailed content of php determines whether image exists. For more information, please follow other related articles on the PHP Chinese website!