php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #26597 missing all slashes in the path $_FILES['any_file']['tmp_name']
Submitted: 2003-12-12 04:50 UTC Modified: 2003-12-15 02:44 UTC
From: valyala at tut dot by Assigned:
Status: Closed Package: Strings related
PHP Version: 4.3.4 OS: Win2k sp3
Private report: No CVE-ID: None
View Developer Edit
 [2003-12-12 04:50 UTC] valyala at tut dot by 
Description:
------------
PHP 4.3.4 is running under apache 1.3.27 as module.

Value of $_FILES['any_file']['tmp_name'] is wrong. All slashes in the path has been deleted. So, I cannot know the real filename of temporary file.

Reproduce code:
---------------
/* file with name 'any_file' was posted to the script
 I want to see, where the temporary file was stored on the server:
*/
print($_FILES['any_file']['tmp_name']);

Expected result:
----------------
c:/winnt/temp/phpXX.tmp


Actual result:
--------------
c:winnttempphpXX.tmp

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2003-12-14 20:41 UTC] sniper@php.net 
Try this:

print(addslashes($_FILES['any_file']['tmp_name']));
 [2003-12-15 02:44 UTC] valyala at tut dot by 
I found my error.
My script was doing something like this:
if (get_magic_quotes_gpc()) $_FILES['any_file']['tmp_name'] = stripslashes($_FILES['any_file']['tmp_name']);
:)
But I can't understand why function stripslashes() strips all backslashes, not only before special characters [0, \, ', "], which escapes function addlashes().
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Thu Mar 13 17:01:30 2025 UTC