php 4.3.11, IE and file upload

The new incoming release of PHP (4.3.11) has a different behaviour on file name upload with IE. While uploading a file using IE the $_FILES[‘myfile’][‘name’] variable returns the entire upload path and not only the file name.

In example

  • firefox: $_FILES[‘myfile’][‘name’] = prova.txt
  • IE: $_FILES[‘myfile’][‘name’] = c:\misc\prova.txt

A possible solution should be to parse the name of the file using the basename function. But this is only an incomplete fix because with Linux the backslash is allowed inside a file name. So a complete fix (also back compatible) is:

[php]
$filename = str_replace(”, ‘/’, $_FILES[‘userfile’][‘name’]);

if (get_magic_quotes_gpc()) {
$filename = basename(stripslashes($filename));
} else {
$filename = basename($filename);
}
echo $filename;
[/php]

Note the use of the stripslashes() function to remove unnecessary data if the magic_quotes_gpc is enabled on the php.ini

Some references:

2 comments ↓

#1 bpwane on 03.25.05 at 6:30 pm

Which file should this code go into?

#2 php4ever on 04.02.05 at 4:05 am

Its also a problem in Firefox and Netscape as I’ve recently discovered.
Jared.