php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #33918 File uploads: apostrophes cause filename to be incorrectly reported
Submitted: 2005-07-29 15:08 UTC Modified: 2005-07-29 15:28 UTC
From: lewis dot peckover at m-w dot co dot uk Assigned:
Status: Closed Package: Unknown/Other Function
PHP Version: 5.0.4 OS: all?
Private report: No CVE-ID: None
View Developer Edit
Welcome back! If you're the original bug submitter, here's where you can edit the bug or add additional notes.
If you forgot your password, you can retrieve your password here.
Password:
Status:
Package:
Bug Type:
Summary:
From: lewis dot peckover at m-w dot co dot uk
New email:
PHP Version: OS:

 

 [2005-07-29 15:08 UTC] lewis dot peckover at m-w dot co dot uk 
Description:
------------
Any file uploaded that has a name containing an apostrophe ('), eg foo'bar.txt, will be incorrectly named in the $_FILES array. It will ignore all characters up to and including the apostrophe.

  foo'bar.txt  ->  bar.txt

Tested on PHP 4.3.10/Apache/FreeBSD 5.3 and PHP 5.0.4/IIS/Windows 2003.

Reproduce code:
---------------
<html>
<body>
<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post" enctype="multipart/form-data">
<input type="file" name="file"><input type="submit">
</form>
<pre>
<?php
print_r($_FILES);
?></pre>
</body>
</html>


Expected result:
----------------
Array
(
    [file] => Array
        (
            [name] => foo'bar.txt
            [type] => text/plain
            [tmp_name] => d:\PHP\uploadtemp\php9B1.tmp
            [error] => 0
            [size] => 9
        )

)

Actual result:
--------------
Array
(
    [file] => Array
        (
            [name] => bar.txt
            [type] => text/plain
            [tmp_name] => d:\PHP\uploadtemp\php9B1.tmp
            [error] => 0
            [size] => 9
        )

)

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-07-29 15:28 UTC] sniper@php.net 
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Sat Nov 01 00:00:01 2025 UTC