I have a module in which the user can upload images.
I searched Google for different kinds of upload attacks

  • checking dimension of the image (still vulnerable)
  • checking of file extension mypicture.php%00.jpg (still vulnerable)
  • checking of mime type (still vulnerable)
    The only solution that I have is to change the file name of uploaded file
    move_uploaded_file($_FILES["pictures"]["tmp_name"] , 'mycustomname'.'jpg');

My question is:
Is there still a way to upload shell file after I've taken these precautions?

  • Add a check to alert the administrator if the folder that will receive the images has any execution permission, so that new files stored in that directory do not have it. Feb 25, 2016 at 21:59

1 Answer 1


You need to do a few more things:

  • Check the file size of the image and enforce a limit (prevent overflows from happening)
  • Along with renaming the file (and storing it with a different name and path than the uploader can recover, preferably on a separate domain), you should also rewrite the file in some minor way (add a bit of random noise) with a tool like ImageMagick.
  • Extract EXIF (and any other similar meta-data) from the file, or just consider converting every image to a bitmap.

Most important -- understand how the executable image exploits work:


  • thanks for your response thanks for the suggestion i will apply it to my module thanks Nov 6, 2012 at 5:35
  • 2
    Note that renaming uploaded files will prevent them from being executed on your server, it won't prevent a malicious user from using your server to host malicious files for other purposes.
    – tylerl
    Nov 6, 2012 at 5:59
  • 3
    A common method is to rename it to the SHA1 hash of the file. This ensures unique naming, and saves you space when duplicates are uploaded.
    – Polynomial
    Nov 6, 2012 at 7:04
  • 1
    @Polynomial If you go that way, at I'd prefer a hash function for which collisions are infeasible. Which excludes SHA-1 and MD5. | Some people consider the ability to retrieve a file for which you know the hash a vulnerability, but I don't agree with them. If you want to avoid this, use some kind of keyed hash. Nov 6, 2012 at 8:07
  • Since when were SHA1 collisions feasible?
    – Polynomial
    Nov 6, 2012 at 8:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .