Question

Docs say:

Returns TRUE if the file named by filename was uploaded via HTTP POST

How could $_FILES['blah']['tmp_name'] possibly not be the result of a POST upload? PHP created this filename.

This is useful to help ensure that a malicious user hasn’t tried to
trick the script into working on files upon which it should not be
working–for instance, /etc/passwd.

I understand that I should carefully check the file contents and size. But how could an attacker control whatsoever the temp filename of the uploaded file?

Or does is_uploaded_file() do some other checks?

Thanks for shedding some light.

Answer 1

Well, you can pass any string to is_uploaded_file.

Sure, if you pass it something straight out of $_FILES then yes of course it’ll always return true, but if you form the argument yourself then it may not.