PHP?? ?? ???? ???? ???? ??

?? ???? ? ??????? ???? ????, ???? ???, ??, ???? ?? ??? ??? ? ??? ????. ??? ?? ???? ??? ???? ??? ?? ??? ????. ???? ????? ???? ?? ?? ??, ??? ?? ????, ??? ?? ?? ?? ???? ??? ? ????.

??? ??? ????? PHP?? ?? ???? ??? ? ?? ??? ???? ?? ?????. ??? ?? ??, ???? ???, ?? ??? ?? ??? ??? PHP?? ?? ???? ???? ???? ??? ?? ???? ??????.

---

1. PHP? ?? ?? ???

PHP?? ?? ???? ???? ??? ?? ??? ???? $_FILES ?????? ?? ?????. ??? ?? ??? ?? ??? ?? ?? ????.

// HTML form for file upload
<form action="upload.php" method="POST" enctype="multipart/form-data">
    <input type="file" name="fileToUpload">





<pre class="brush:php;toolbar:false">// PHP script to handle file upload (upload.php)
if (isset($_POST['submit'])) {
    $targetDir = "uploads/";
    $targetFile = $targetDir . basename($_FILES["fileToUpload"]["name"]);
    $uploadOk = 1;
    $fileType = strtolower(pathinfo($targetFile, PATHINFO_EXTENSION));

    // Check if the file already exists
    if (file_exists($targetFile)) {
        echo "Sorry, file already exists.";
        $uploadOk = 0;
    }

    // Check file size (limit to 5MB)
    if ($_FILES["fileToUpload"]["size"] > 5000000) {
        echo "Sorry, your file is too large.";
        $uploadOk = 0;
    }

    // Check file type (allow only certain types)
    if ($fileType != "jpg" && $fileType != "png" && $fileType != "jpeg") {
        echo "Sorry, only JPG, JPEG, and PNG files are allowed.";
        $uploadOk = 0;
    }

    // Check if upload was successful
    if ($uploadOk == 0) {
        echo "Sorry, your file was not uploaded.";
    } else {
        if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $targetFile)) {
            echo "The file ". htmlspecialchars(basename($_FILES["fileToUpload"]["name"])). " has been uploaded.";
        } else {
            echo "Sorry, there was an error uploading your file.";
        }
    }
}

---

2. ???? ?? ??? ???

1. ?? ?? ???: ???? ???? ??? ??? ???? PHP ???? ? ???? ? ???? ??? ?? ????? ???? ? ????.
2. ?? ?? ???: ??? ??? ????? ??? ???? ?? ??? ??(DoS)? ??? ? ????.
3. ?? ?? ????: ???? ?? ??? ??? ??? ??? ??? ????? ???? ????? ??? ???? ??? ??? ??? ? ????.
4. ???? ??: ?? ??? ???? ??? ???? ??? ??? ???? ? ???? ???? ??? ??? ??? ? ????.

---

3. PHP? ?? ?? ??? ?? ??

?. ?? ?? ??

?? ?? ???? MIME ??? ???? ?? ??? ???? ?????. ??? ?? ???? ? ???? ?? ????? ???? ????.

// Get the file's MIME type
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$fileMimeType = finfo_file($finfo, $_FILES["fileToUpload"]["tmp_name"]);

// Check against allowed MIME types
$allowedMimeTypes = ['image/jpeg', 'image/png', 'image/gif'];
if (!in_array($fileMimeType, $allowedMimeTypes)) {
    die("Invalid file type. Only JPEG, PNG, and GIF are allowed.");
}

?. ?? ?? ??

?? ???? ???? ? ?? ??? ???? ????? ?? ?? ?? ??? ?????. php.ini? PHP ??? ?? ? ??? ??? ? ????:

upload_max_filesize = 2M  // Limit upload size to 2MB
post_max_size = 3M  // Ensure post data size can accommodate the upload

?? $_FILES['file']['size']:
? ???? ?? ??? ?? ??? ?????.

if ($_FILES["fileToUpload"]["size"] > 5000000) { // 5MB
    die("File is too large. Max allowed size is 5MB.");
}

?. ???? ?? ?? ???

?? ??? ????? ??? ? ???? ?? ?? ??? ???? ???. ?? ?? ??? ?? ???? ????(?: ??? ??? ?? uniqid() ??).

// HTML form for file upload
<form action="upload.php" method="POST" enctype="multipart/form-data">
    <input type="file" name="fileToUpload">





<pre class="brush:php;toolbar:false">// PHP script to handle file upload (upload.php)
if (isset($_POST['submit'])) {
    $targetDir = "uploads/";
    $targetFile = $targetDir . basename($_FILES["fileToUpload"]["name"]);
    $uploadOk = 1;
    $fileType = strtolower(pathinfo($targetFile, PATHINFO_EXTENSION));

    // Check if the file already exists
    if (file_exists($targetFile)) {
        echo "Sorry, file already exists.";
        $uploadOk = 0;
    }

    // Check file size (limit to 5MB)
    if ($_FILES["fileToUpload"]["size"] > 5000000) {
        echo "Sorry, your file is too large.";
        $uploadOk = 0;
    }

    // Check file type (allow only certain types)
    if ($fileType != "jpg" && $fileType != "png" && $fileType != "jpeg") {
        echo "Sorry, only JPG, JPEG, and PNG files are allowed.";
        $uploadOk = 0;
    }

    // Check if upload was successful
    if ($uploadOk == 0) {
        echo "Sorry, your file was not uploaded.";
    } else {
        if (move_uploaded_file($_FILES["fileToUpload"]["tmp_name"], $targetFile)) {
            echo "The file ". htmlspecialchars(basename($_FILES["fileToUpload"]["name"])). " has been uploaded.";
        } else {
            echo "Sorry, there was an error uploading your file.";
        }
    }
}

?. ? ?? ??? ?? ??

???? ??(?: ?? PHP ????)? ??? ????? ???? ??? ? ?? ?? ?? ??? ???? ?? ??? ?????.

?? ??, uploads/? ?? ????? ??? ???? ?? ??? PHP ??? ?? ???? ??? ???? ?? ???? ??? ?????.

// Get the file's MIME type
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$fileMimeType = finfo_file($finfo, $_FILES["fileToUpload"]["tmp_name"]);

// Check against allowed MIME types
$allowedMimeTypes = ['image/jpeg', 'image/png', 'image/gif'];
if (!in_array($fileMimeType, $allowedMimeTypes)) {
    die("Invalid file type. Only JPEG, PNG, and GIF are allowed.");
}

e. ????? ??

??? ??? ?? ???? getimagesize()? ?? ????? ??? ?? ?? ?? ??? ???? ??? ??? PHP ??? ??? ??? ????? ?????.

upload_max_filesize = 2M  // Limit upload size to 2MB
post_max_size = 3M  // Ensure post data size can accommodate the upload

f. ??? ?? ??

???? ??? ??? ??? ?? ?? ?? ???? ??? ?????. ?? ???? ????? ???? ?? ??? ?????.

if ($_FILES["fileToUpload"]["size"] > 5000000) { // 5MB
    die("File is too large. Max allowed size is 5MB.");
}

?. ?? ???? ??

?? ??? ?? ????? ???? ?? ??(?: ???? ??)? ??? ??? ?? ???? ?????.

$targetFile = $targetDir . uniqid() . '.' . $fileType;

?. ???? ?? ?? ???

??? ????? ???? ?? ???? ???? ???? ??? ??? ?? ?? ??? ??? ???? ?? ????. ?? ? ??????? ??? ?? ClamAV? ?? ???? ?????.

---

4. ??? ?? ??? ?? ??

??? ? ?? ?? ??? ???? ?? ???? ???? ???? ????.

# For Nginx, configure the server to block PHP execution in the upload folder:
location ~ ^/uploads/ {
    location ~ \.php$ { deny all; }
}

---

5. ??

PHP?? ?? ???? ???? ????? ?? ?? ???, ??? ?? ???, ??? ?? ???? ?? ??? ???? ?? ??? ?? ??? ??? ?????. ?? ?? ??? ??? ????, ???? ??? ??? ???, ? ?? ??? ????, ??? ??? ??????. ??? ?? ?? ??? ??? ???? ???? ?? ??? ?? ? ????.

? ??? PHP? ??? ?? ??? ?? ??: ???? ??? ??? ?? ?????. ??? ??? PHP ??? ????? ?? ?? ??? ?????!