Home/ Questions/Q 341921
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-12T10:45:14+00:00

I am trying to assess our security risk if we allow to have a

  • 0

I am trying to assess our security risk if we allow to have a form in our public website that lets the user upload any type of file and get it stored in the database.

I am worried about the following:

  • Robots uploading information
  • A huge increment of the size of the database
  • The form is an resume upload so HR people will be downloading those files in a jpeg or doc or pdf format but actually getting a virus.
Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You can do multiple checking for your file upload control.

    1) Checking the extension of file (.wmv, .exe, .doc). This can be implemented by Regex expression.

    2) Actually check the file header or definition type (ex: gif, word, image, etc, xls). Sometimes file extension is not sufficient.

    3) Limit the file size. (Ex: 20mb)

    4) Never accept the filename provided by the user. Always rename the file to some GUID according to your specifications. This way hacker wont be able to predict the actual name of the file which is stored on the server.

    5) Store all the files out of web virtual directory. Preferably store in separate File Server.

    6) Also implement the Captcha for File upload.

    • 0