# PHP Documentation Problem 100th time

- Thread: https://externals.io/message/12634
- Original archive: https://news-web.php.net/php.internals/12634
- Started by Stefan Esser on 2004-09-07T18:14:04+00:00
- Messages: 4
- Reply by email to internals@lists.php.net
- More for agents: search with https://externals.io/search.md?q={query} · JSON API at https://externals.io/api · documentation at https://externals.io/llms.txt

---

## #12634 — Stefan Esser — 2004-09-07T18:14:04+00:00

URL: https://externals.io/message/12634#12634

Hi,

I just realised that

Example 34-2. Validating file uploads

Is still showing a bullshit example. It constructs a destination path 
for `move_uploaded_file()` that consists of user input. There is no sanity 
check on it like removing / and .. sequences.

Can one of the DOC guys finally fix this code?

Stefan Esser

---

## #12641 — Hartmut Holzgraefe — 2004-09-08T00:15:40+00:00

URL: https://externals.io/message/12634#12641 · In reply to: #12634

Stefan Esser wrote:
> Example 34-2. Validating file uploads
> 
> Is still showing a bullshit example. It constructs a destination path 
> for `move_uploaded_file()` that consists of user input. There is no sanity 
> check on it like removing / and .. sequences.

Would you agree that aplying `basename()` would be ok as a quick fix?

   $uploadfile .= basename($_FILES['userfile']['name']);

instead of

   $uploadfile = $uploaddir . $_FILES['userfile']['name'];

?

(in the long run i should voluntere to rewrite this, folding in
  information of my former magazine article on securing uploads ...)

-- 
Hartmut Holzgraefe  <hartmut@php.net

---

## #12642 — Hartmut Holzgraefe — 2004-09-08T00:27:22+00:00

URL: https://externals.io/message/12634#12642 · In reply to: #12634

phpdoc@lists.php.net is the right list for stuff like this btw ...

-- 
Hartmut Holzgraefe  <hartmut@php.net

---

## #12643 — Philip Olson — 2004-09-08T00:40:57+00:00

URL: https://externals.io/message/12634#12643 · In reply to: #12634

> I just realised that
> 
> Example 34-2. Validating file uploads
> 
> Is still showing a bullshit example. It constructs a destination path 
> for `move_uploaded_file()` that consists of user input. There is no sanity 
> check on it like removing / and .. sequences.
> 
> Can one of the DOC guys finally fix this code?

How about you provide a patch? Or a real suggestion? Instead 
of some insulting subject and message. In the very least you
may use bugs.php.net to file a bug report.

Regards,
Philip