Re: [PHP] Re: security of uploaded gif files

2006-01-23 Thread Gustavo Narea
Hi, Gerry. Gerry Danen wrote: There's a couple of things a person can do. 1. check for .gif extention 2. see if exif_imagetype() returns type IMAGETYPE_GIF 3. see if getimagesize() returns reasonable values and not FALSE 4. check the file content for binary vs text content It's enough to know

[PHP] Re: security of uploaded gif files

2006-01-23 Thread Gustavo Narea
Hi, James. James Benson wrote: Even if you can embed PHP in a GIF it would still need to be executed by PHP as PHP code, would PHP actually execute that file when it looks like an image, I would think PHP would output an error? Unless you include/require or eval() its content, PHP won't execu

Re: [PHP] Re: security of uploaded gif files

2006-01-23 Thread Gerry Danen
There's a couple of things a person can do. 1. check for .gif extention 2. see if exif_imagetype() returns type IMAGETYPE_GIF 3. see if getimagesize() returns reasonable values and not FALSE 4. check the file content for binary vs text content Gerry -- PHP General Mailing List (http://www.php.ne

[PHP] Re: security of uploaded gif files

2006-01-23 Thread James Benson
Even if you can embed PHP in a GIF it would still need to be executed by PHP as PHP code, would PHP actually execute that file when it looks like an image, I would think PHP would output an error? More importantly though, you should be checking the file extension of uploaded files to make sur

[PHP] Re: security of uploaded gif files

2006-01-23 Thread Barry
James Benson wrote: Even if you can embed PHP in a GIF it would still need to be executed by PHP as PHP code, would PHP actually execute that file when it looks like an image, I would think PHP would output an error? More importantly though, you should be checking the file extension of uploa