Beginner PHP Tutorial - 90 - Uploading Files: Restricting File Extensions Part 1 Video Lecture | PHP for Absolute Beginners: From Novice to PHP Master - Web Development

hello this is Alex from PHP academy' org
and this is another video for the new
Boston now we've already looked at file
uploads and how we can upload different
files or or any file rather which is uh
thinking about it quite insecure now
let's say you had a website that allowed
their users to upload images you might
want to specify a select amount of file
types that you can accept and those were
you don't need to specify those you
don't accept but you do need to perform
checks now at the moment I've uploaded a
couple of files so these are jpg but
what happens if I go to upload a file
that perhaps doesn't have a jpg
extension now obviously we haven't
specified anywhere in upload dot PHP
where we can't do this so let's go to
upload PHP and let's create a new file
let's say and a PHP document so I'm
going to call this a file dot PHP so
we'll change that file extension now
what happens if I select this you can
see it's been selected and I click
Submit you can see that it's actually
uploaded the file now let's go back to
our uploads directory you can see this
file now exists on the server so if I
click on that that's run the file now
obviously without without explaining
this is a very unsecure we have accepted
a PHP file type automatically because we
have no checks in place to only allow a
certain file type so how do we do this
now we've already discussed in the last
video the size and the type properties
of our father' we've uploaded
we're also going in this tutorial check
for the tutorial size in fact we'll do
that in the next video because we might
run out of time so we want to check for
the type of file ok so where do we start
let's just echo out what what we see
here when we upload so we'll kill the
page just here and let's go back and
we'll upload or click no go on upload up
here HP ok so um oh yeah we've killed
the script hmmm we right um let's
comment this out then okay so back to
our file ok so I'm going to choose a
file I'm going to choose file dot PHP
again I'm going to click Submit and it's
got application forward slash octet
stream so um we could go through a long
list of file types we don't allow
however if I was to click on this you
can see it shows the image forward slash
JPEG so what we want to do is we want
the file type to equal this or we want
it to equal like another file type in
this case I'm just going to be doing a
JPEG but what we also need to do is take
the filename itself so the name of the
father we're uploading which is
specified here so let's just concatenate
a break on tin that for example purposes
so if we refresh that you can see that
this is the name and this is the and
this is the file type here so how are we
going to go about checking if this has
an extension of jpg what we need to do
is we need to use the string position
function and also the substring function
what we'll do is we'll be using the
substring function to find where these
dot is then we're going to be using the
string oh no the string position
sorry function to find out where the
dyers then we're going to be using the
substring function to select everything
after the dot so that's it and then
we've got we end up with this jpg here
and I'm going to demonstrate that first
of all and just so we get that clear so
we're going to sort of need to play
around a bit with that with our function
so that's just a we'll keep that um
commented out for now
right okay so let's not echo these out
anymore but what we need to do is we
need to start dealing with the extension
so I'm going to create a new variable
called extension now I'm going to start
with a substring function and this is
going to take two arguments the first
argument is going to take is the input
that you want so that's name and the
second argument is going to take is
where you want to cut from an end so
we're taking in this this parameter we
want to start from a specific position
and everything else after that will be
regarded as text so for example let's
let's assume that we know the position
so we've got 1 2 3 4 5 6 7 8 9 10 11 12
13 14 15 16 17 so because we're starting
at 0 that will be 18 so 18 we've got the
extension that so let's echo out the
extension and see what happens