PHP-我应该清理$ _FILES [“文件名”] [“ tmp_name”]

Question

Before I call move_uploaded_file, should I do anything about this specific variable:

$_FILES["filename"]["tmp_name"]

Thank you

Answer 1

No. That's generated and assigned by PHP, and will be useless/invalid the moment your script exits, as PHP will delete any uploaded files which you have not dealt with yet. It'll be something like "/tmp/a34632rsfd234". There's no point in preserving its value. However, $_FILES['filename']['name'] is the original filename of the file from the client's machine, and if you're preseving that, then you need to treat it as toxic waste and sanitize it.

Answer 2

There's not much you can do with the variable itself, but you should test the file to ensure that it is of the type you were expecting—an image, for example. Never rely on the file extension for determining the file type. Don't, for example, assume that something with a .jpg extension is actually a JPEG file.

Answer 3

否，因为其中的值将始终是文件系统的有效文件名（因为它指向磁盘上的文件）。