How can I prevent the uploading of a file using file extensions?

That's interesting David,
I'll give both approaches a shot tomorrow and let you know how it works out.
At first glance it looks quite logical.
Thanks
Sas

Maybe put the files you will accept (or will not accept) in an array and check if the item is in that array?

https://www.php.net/manual/en/function.in-array.php

$not_allowed= array("html ", "php", "exe");
if (in_array($file, $not_allowed )) {
    echo "Sorry! You can't upload that kind of file";
}

Select allOpen in new window

To David & Scott,
Thanks for the help guys.

To David:
I'm having trouble getting the FilePath for your very first line of code.

$pathparts = pathinfo('/www/htdocs/inc/index.php');

Select allOpen in new window

I tried using $FilePATH = $_SERVER['PATH_INFO']; to get the path, but it comes back empty.
So I made one minor change to that line of code.

$pathparts = pathinfo('$File');

Select allOpen in new window

Presto! It worked!


To Scott:
Your code looks extremely simple and makes a lot of sense—perfect sense. I like it. But it fails!

Simply saying it fails does not help me :)  You have try and see what the issue is and adjust.

Try this

$file = "somefile.php"; //FILE WE AR CHECKING
$file_type = substr($file,-3);  //GET THE FILE TYPE BY THE LAST THREE CHARACTERS

$not_allowed= array("html ", "php", "exe");  // NOT ALLOWED LIST

if (in_array($file_type, $not_allowed )) { // CHECK IF FILE IS IN THE NOT ALLOWED LIST
    echo "Sorry! You can't upload that kind of file";
} else {

    echo "This is a good file";
}

Select allOpen in new window

https://www.php.net/manual/en/function.substr.php
https://www.php.net/manual/en/function.in-array.php

Okay Guys. Both solutions function brilliantly.
Is there any reason why one version should be better than the other?
Sas

What works is what counts. We could probably come up with 10 more options.

If you were to create a database of file types, then instead of

$not_allowed= array("html ", "php", "exe");  // NOT ALLOWED LIST

you would replace that with the array generated by the query