2 回答
TA贡献1796条经验 获得超7个赞
您可以使用uniqid 函数和pathinfo 函数。像这样(未经测试):
if (isset($_POST['upload']) && isset($_POST['datae'])) {
$uploadPath = '../Upload/' . $_POST['datae'];
if (file_exists($uploadPath)) {
$pathInfo = pathinfo($uploadPath);
$uniqueId = uniqid('_copy_');
$uploadPath = $pathInfo['dirname'] . '/' . $pathInfo['filename'] . $uniqueId . '.' . $pathInfo['extension'];
}
copy('../print/'.$_POST['datae'], $uploadPath);
}
您的代码中还有一个潜在的漏洞:有人可以使用 post 参数创建任何路径,例如:
$_POST['datae'] = '../../../env_file_with_passwords_file_from_protected_dir'
为避免这种情况,请阅读此文档文章。在您的情况下,您可以检查文件名以确保有人不会试图窃取您的文件:
if (isset($_POST['upload']) && isset($_POST['datae']) && preg_match('/^[a-z0-9_]+\.[a-z0-9_]+$/i', $_POST['datae'])) {
copy('../print/'.$_POST['datae'], '../Upload/'.$_POST['datae']);
echo "<meta http-equiv='refresh' content='1'>";
}
- 2 回答
- 0 关注
- 165 浏览
添加回答
举报