消毒上傳使用PHP

Question

我使用這個代碼上傳多個images.I要添加圖像消毒代碼，以防止任何attack.I也想用MD5哈希algorithm..How重命名上傳的文件唯一的名稱可以多張圖片我做這些事..請幫助我..

<?php 

if($_SERVER['REQUEST_METHOD'] == "POST") 
if(isset($_FILES['file'])) 
{ 
$count = 0; 
$errors= array(); 
foreach($_FILES['file']['tmp_name'] as $key => $tmp_name) 
{ 
$file_name = $key.$_FILES['file']['name'][$key]; 
$file_size =$_FILES['file']['size'][$key]; 
$file_tmp =$_FILES['file']['tmp_name'][$key]; 
$file_type=$_FILES['file']['type'][$key]; 

$size = getimagesize($_FILES['file']['tmp_name'][$key]); 
if ($size === FALSE) { 
die("Oopz,This is not an image"); 
} 


$enc_id= $_POST['form_id'].$_POST['name3']; 
$md5folder = md5($enc_id); 
$upload_path ="uploads/".$md5folder; 

if(!is_dir($upload_path)) 
{ 
mkdir($upload_path, 0777, true); 
} 

if(empty($errors)==true) 
    { 
move_uploaded_file($file_tmp,$upload_path.'/'.$file_name); 
    } 

} 
?> 

另外我想知道這部分代碼有什麼意義嗎？

$size = getimagesize($_FILES['file']['tmp_name'][$key]); 
if ($size === FALSE) { 
die("Oopz,This is not an image"); 
} 

Answer 1

使用該消毒數據庫輸入：

function cleanInput($input) { 

$search = array(
'@<script[^>]*?>.*?</script>@si', // Strip out javascript 
'@<[\/\!]*?[^<>]*?>@si',   // Strip out HTML tags 
'@<style[^>]*?>.*?</style>@siU', // Strip style tags properly 
'@<![\s\S]*?--[ \t\n\r]*>@'   // Strip multi-line comments 
); 

$output = preg_replace($search, '', $input); 
return $output; 
} 
?> 
<?php 
function sanitize($input) { 
if (is_array($input)) { 
    foreach($input as $var=>$val) { 
     $output[$var] = sanitize($val); 
    } 
} 
else { 
    if (get_magic_quotes_gpc()) { 
     $input = stripslashes($input); 
    } 
    $input = cleanInput($input); 
    $output = mysql_real_escape_string($input); 
} 
return $output; 
} 

使用此來計算MD5哈希值只有文件名：

$image = "image1.jpg"; 
$filehash = md5($image);