How to Secure Uploader

[anderson]

It's long time since I am thinking about to make a secured uploader. I haven't yet add any uploader in my wml lava site due to security issue. But now-a-days many request me for a uploader sothat they can upload their images happily. However, I want to put a secured uploader now.
==================
Now guys I want to have ideas from you all on how can I make my uploader secured.
With all the security functions, additionally I want such a uploader that should have the functions like below:

1. Allows only image(.gif/.jpg/.jpeg/.png/.bmp) MIME type files.
2. Maximum file size supports 50KB.
3. "Uploaded file under moderator processing system" sothat site staffs can check the uploaded files before publishing.
==================
==================
Now please give me ideas or codes for it.

[kiLLeR-eyEd_14]

It's long time since I am thinking about to make a secured uploader. I haven't yet add any uploader in my wml lava site due to security issue. But now-a-days many request me for a uploader sothat they can upload their images happily. However, I want to put a secured uploader now.
==================
Now guys I want to have ideas from you all on how can I make my uploader secured.
With all the security functions, additionally I want such a uploader that should have the functions like below:

1. Allows only image(.gif/.jpg/.jpeg/.png/.bmp) MIME type files.
2. Maximum file size supports 50KB.
3. "Uploaded file under moderator processing system" sothat site staffs can check the uploaded files before publishing.
==================
==================
Now please give me ideas or codes for it.

just limit the extensions of a file to be uploaded

[bijaybd]

just limit the extensions of a file to be uploaded

still my site got hacked by for the uploading system the delete my database so how to secure the hack ????? i got file extention gif and jpeg but how they do that i really dont know

[ori]

u have to make sure the content type is same as the extension

$image_type = array("image/jpeg","image/pjpeg","image/gif","image/x-png","image/bmp");
$ext = strtolower(strrchr($_FILES['filetoupload'][name],'.'));
$file_type = $_FILES['filetoupload']['type'];
if (!in_array($ext,$image_ext) && in_array($file_type,$image_type)) echo "Content type must be image."; 

thats just an example from my uploader
</SPAN></SPAN>

[ori]

should also stop ur download folders from loading php files thru url / hotlinking etc

[anderson]

should also stop ur download folders from loading php files thru url / hotlinking etc

Want more tips here to make uploader secured. @ ori n other coders

[kuklux]

hide ur image url dir! Get idea from the E-Cards! just like what i did in mah site!

[anderson]

hide ur image url dir! Get idea from the E-Cards! just like what i did in mah site!

good point.

plz tell me more tips @ all

[wapmetal]

U need .Htaccess w/c denies other files exect image format. .And even they kn0w the page dir . it shows that they have n0 permizion to view the folder

[killfrenzy]

put .htaccess...only file that only upload are include...

[blackhowk]

upload images and in the same time change the name of images.insert the new name of image into database.keep the name into database and the name of folder for upload secret(storage).generate image link for viewers into new folder(deliver folder) and in the same time copy and rename the image from storage into deliver.empty deliver folder periodic with a value cron in kb of deliver folder.this prevent hot linking.if you want to resize images at the same value resize in deliver folder.

[kiLLeR-eyEd_14]

just limit the extensions of a file to be uploaded

still my site got hacked by for the uploading system the delete my database so how to secure the hack ????? i got file extention gif and jpeg but how they do that i really dont know

use a resizer of image..just search here..use it for holding images..then make some codes, if the image is a remote file then use header("Location: $imageurl")..

[bijaybd]

use a resizer of image..just search here..use it for holding images..then make some codes, if the image is a remote file then use header("Location: $imageurl")..

i use phpthumb but still the same thing happening why i really dont know even the image file renamed autometically like if its baby.gif it goes lyk 1234.gif but still same

[ori]

my uploader directory denies even the allowed file types i use a grab file to download files so folder is hidden plus files cant be accessed even if they guess the folder

[friend]

Put code in upload file that some chatpost req to upload files so regular chatter only can upload file .... Also put denied in htacess for php.jpeg etc