【发布时间】:2014-03-23 05:35:34
【问题描述】:
我做了一个上传系统,我在我的电脑上测试它,使用localhost xampp 服务器,它工作正常,但我把它移到主机上,我收到了这个错误:
PHP Warning: Unknown: open_basedir restriction in effect. File(C:\Windows\TEMP) is not within the allowed path(s): (E:\Domains\site.com) in Unknown on line 0
PHP Warning: File upload error - unable to create a temporary file in Unknown on line 0
PHP Warning: file_get_contents() [<a href='function.file-get-contents'>function.file-get-contents</a>]: Filename cannot be empty in E:\Domains\site.com\wwwroot\admin\addexec.php on line 12
PHP Warning: getimagesize() [<a href='function.getimagesize'>function.getimagesize</a>]: Filename cannot be empty in E:\Domains\site.com\wwwroot\admin\addexec.php on line 14
以下是文件:
addexec.php
<?php
include('connect.php');
if (!isset($_FILES['image']['tmp_name'])) {
echo "";
}else{
$file=$_FILES['image']['tmp_name'];
$image= addslashes(file_get_contents($_FILES['image']['tmp_name']));
$image_name= addslashes($_FILES['image']['name']);
$image_size= getimagesize($_FILES['image']['tmp_name']);
if ($image_size==FALSE) {
echo "That's not an image!";
}else{
move_uploaded_file($_FILES["image"]["tmp_name"],"../reservation/img/products/" . $_FILES["image"]["name"]);
$location=$_FILES["image"]["name"];
$pname=$_POST['pname'];
$desc=$_POST['desc'];
$price=$_POST['price'];
$cat=$_POST['cat'];
$update=mysql_query("INSERT INTO products (imgUrl, product, Description, Price, Category)
VALUES
('$location','$pname','$desc','$price','$cat')");
header("location: products.php");
exit();
}
}
?>
我不知道如何准确设置临时文件夹,我需要一些帮助来解决这个问题。我能做些什么?我已经将服务器上的权限设置为777,并关闭了php安全模式。
【问题讨论】:
-
您需要在您的 PHP.ini 中取消注释
open_basedir。 -
您的代码易受 SQL 注入攻击;你应该阅读how to prevent them in PHP。您还应该检查上传文件的扩展名,否则可以上传任何文件,包括
.php文件。
标签: php image file upload temp