php.net |  support |  documentation |  report a bug |  advanced search |  search howto |  statistics |  random bug |  login

go to bug id or search bugs for

Bug #33918 File uploads: apostrophes cause filename to be incorrectly reported
Submitted: 2005-07-29 15:08 UTC Modified: 2005-07-29 15:28 UTC
From: lewis dot peckover at m-w dot co dot uk Assigned:
Status: Closed Package: Unknown/Other Function
PHP Version: 5.0.4 OS: all?
Private report: No CVE-ID: None
View Developer Edit
 [2005-07-29 15:08 UTC] lewis dot peckover at m-w dot co dot uk 
Description:
------------
Any file uploaded that has a name containing an apostrophe ('), eg foo'bar.txt, will be incorrectly named in the $_FILES array. It will ignore all characters up to and including the apostrophe.

  foo'bar.txt  ->  bar.txt

Tested on PHP 4.3.10/Apache/FreeBSD 5.3 and PHP 5.0.4/IIS/Windows 2003.

Reproduce code:
---------------
<html>
<body>
<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post" enctype="multipart/form-data">
<input type="file" name="file"><input type="submit">
</form>
<pre>
<?php
print_r($_FILES);
?></pre>
</body>
</html>


Expected result:
----------------
Array
(
    [file] => Array
        (
            [name] => foo'bar.txt
            [type] => text/plain
            [tmp_name] => d:\PHP\uploadtemp\php9B1.tmp
            [error] => 0
            [size] => 9
        )

)

Actual result:
--------------
Array
(
    [file] => Array
        (
            [name] => bar.txt
            [type] => text/plain
            [tmp_name] => d:\PHP\uploadtemp\php9B1.tmp
            [error] => 0
            [size] => 9
        )

)

Patches

Pull Requests

History

AllCommentsChangesGit/SVN commitsRelated reports
 [2005-07-29 15:28 UTC] sniper@php.net 
This bug has been fixed in CVS.

Snapshots of the sources are packaged every three hours; this change
will be in the next snapshot. You can grab the snapshot at
http://snaps.php.net/.
 
Thank you for the report, and for helping us make PHP better.
 
PHP Copyright © 2001-2025 The PHP Group
All rights reserved. 		Last updated: Sun May 11 12:01:27 2025 UTC