$_FILE single quotes causes empty name

Question

If i upload file with single quotes that will cause empty name when i do print_r to $_FILE. for example, file named 2'.ogg that system would output .ogg. I think that windows causes this, but i'm not sure. here the code i'm using:

<?php
if(isset($_POST['submit'])) { 
   print_r($_FILES); 
}
echo <<<Print
<form action='' method="POST" enctype="multipart/form-data">
<input type="file" name="t[]"> <input type="submit" name="submit">
</form>
Print;
?>

Need to check raw http request with this filename. addslashes is not needed. Maybe it's the "magic quotes" issue in old PHP. — Deadooshka, May 23 '15 at 10:06
I thought about it, but there is no magic quotes in new versions. — user3063602, May 23 '15 at 13:30
browser sends filename like this `Content-Disposition: form-data; name="t[]"; filename="2'.ogg"`. Maybe server incorrectly parses this single quote. — Deadooshka, May 23 '15 at 14:15
tried this case on apache/php5.6, and found no problem with single quotes. Have to find software or module that parses the filename. — Deadooshka, May 24 '15 at 05:24

score 0 · Answer 1 · answered May 23 '15 at 08:43

0

Use addslashes() to escape single quote and stripcslashes() to remove added slashes.

answered May 23 '15 at 08:43

Sagar

642
3
14

$_FILE single quotes causes empty name

1 Answers1