PHP图像上传安全检查清单

Question

我正在编写脚本以将图像上传到我的应用程序。以下安全步骤是否足以使应用程序从脚本角度安全？使用.httaccess禁止PHP在上传文件夹中运行。如果文件名包含字符串“ php”，则不允许上传。仅允许扩展名：jpg，jpeg，gif和png。仅允许图像文件类型。禁止使用两种文件类型的图像。更改图像名称。上载到不是根目录的子目录。这是我的脚本： $filename=$_FILES['my_files']['name']; $filetype=$_FILES['my_files']['type']; $filename = strtolower($filename); $filetype = strtolower($filetype); //check if contain php and kill it  $pos = strpos($filename,'php'); if(!($pos === false)) {  die('error'); } //get the file ext $file_ext = strrchr($filename, '.'); //check if its allowed or not $whitelist = array(".jpg",".jpeg",".gif",".png");  if (!(in_array($file_ext, $whitelist))) {    die('not allowed extension,please upload images only'); } //check upload type $pos = strpos($filetype,'image'); if($pos === false) {  die('error 1'); } $imageinfo = getimagesize($_FILES['my_files']['tmp_name']); if($imageinfo['mime'] != 'image/gif' && $imageinfo['mime'] != 'image/jpeg'&& $imageinfo['mime']      != 'image/jpg'&& $imageinfo['mime'] != 'image/png') {   die('error 2'); }//check double file type (image with comment)if(substr_count($filetype, '/')>1){die('error 3')} // upload to upload direcory  $uploaddir = 'upload/'.date("Y-m-d").'/' ;if (file_exists($uploaddir)) {  } else {      mkdir( $uploaddir, 0777);  }    //change the image name $uploadfile = $uploaddir . md5(basename($_FILES['my_files']['name'])).$file_ext;  if (move_uploaded_file($_FILES['my_files']['tmp_name'], $uploadfile)) { echo "<img id=\"upload_id\" src=\"".$uploadfile."\"><br />";  } else {   echo "error";  }欢迎任何新提示：）