使用 php 清理上传的多张图片

Question

I'm using this code for uploading multiple images.I want to add image sanitizing codes for preventing any attack.I also want to rename uploaded files to unique name using md5 hash algorithm..How can i do these things..Please help me..

<?php

if($_SERVER['REQUEST_METHOD'] == "POST")
if(isset($_FILES['file']))
{
$count = 0;
$errors= array();
foreach($_FILES['file']['tmp_name'] as $key => $tmp_name )
{
$file_name = $key.$_FILES['file']['name'][$key];
$file_size =$_FILES['file']['size'][$key];
$file_tmp =$_FILES['file']['tmp_name'][$key];
$file_type=$_FILES['file']['type'][$key];  

$size = getimagesize($_FILES['file']['tmp_name'][$key]);
if ($size === FALSE) {
die("Oopz,This is not an image");
}


$enc_id= $_POST['form_id'].$_POST['name3'];
$md5folder = md5($enc_id); 
$upload_path ="uploads/".$md5folder;

if(!is_dir($upload_path))
{
mkdir($upload_path, 0777, true);
}

if(empty($errors)==true)
   {
move_uploaded_file($file_tmp,$upload_path.'/'.$file_name);
   }

}
?>

Also I want know does this part of code makes any sense?

$size = getimagesize($_FILES['file']['tmp_name'][$key]);
if ($size === FALSE) {
die("Oopz,This is not an image");
}

Answer 1

Use this to sanitize database inputs:

function cleanInput($input) {

$search = array(
'@<script[^>]*?>.*?</script>@si',   // Strip out javascript
'@<[\/\!]*?[^<>]*?>@si',            // Strip out HTML tags
'@<style[^>]*?>.*?</style>@siU',    // Strip style tags properly
'@<![\s\S]*?--[ \t\n\r]*>@'         // Strip multi-line comments
);

$output = preg_replace($search, '', $input);
return $output;
}
?>
<?php
function sanitize($input) {
if (is_array($input)) {
    foreach($input as $var=>$val) {
        $output[$var] = sanitize($val);
    }
}
else {
    if (get_magic_quotes_gpc()) {
        $input = stripslashes($input);
    }
    $input  = cleanInput($input);
    $output = mysql_real_escape_string($input);
}
return $output;
}

Use this to calculate md5 hash for the file name only:

$image = "image1.jpg"; 
$filehash = md5($image );