PHP-为什么可以通过$ _File数组获取pathinfo

Question

why should I use this code to get the name of the file?

$filename = pathinfo($_FILES['file']['name'], PATHINFO_FILENAME)

If I could also get the name through this code:

$filename = $_File['file']['name']

Thank you very much! I'm a beginner in PHP, so sorry if the question is too dumb :D

Answer 1

Because $_File['file']['name'] comes from the user end, and although ordinarily it is just the file name, an ill-intentioned user can actually set it to whatever he wants (example: full path name to overwrite files in the server) and you have to filter it just like every other user input to prevent an attack vector in your system.

Same is true for everything in $_FILE , don't trust the informed MIME type , don't save files without checking if the extension is safe (saving a .php file will be a disaster) etc.

For example, I've seen a system that would trust files of type equal to image/jpeg and other image types, and then saves it without checking the actual file extension. A forged request can inject a .php shell script to this website's upload folder and be used to take control.