php - 将 basename 函数与 $_FILES ['userFile' ] ['name' ] 一起使用不是多余的吗？

Question

根据 the POST method uploads section的 the PHP Manual , $_FILES['userfile']['name'] 是客户端机器上文件的原始名称。该部分中的示例 #2 使用 basename使用 $_FILES['userfile']['name'] 的函数如下所示:

$uploaddir = '/var/www/uploads/';
$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);

我在本地主机(Apache 2.2.14、PHP 5.3.1、Windows XP)上做了一些实验，发现以下两行是等价的:

$_FILES['userFile']['name'];            // "file.txt"
basename($_FILES['userFile']['name']);  // "file.txt"

也就是说，将 basename 函数与 $_FILES['userFile']['name'] 一起使用似乎是多余的。不是吗？

Answer 1

That is, using the basename function with $_FILES['userFile']['name'] seems rather redundant. Isn't it?

不，正如@Gumbo 在他的回答中所描述的那样，首先是出于安全原因；其次，因为旧版本的 IE 过去常常在客户端提供文件的完整路径，比如

C:\Documents and Settings\Username\Desktop\Image_cropped.jpg

这种行为最近在 IE8 中停止了。来自 this MSDN blog entry通过 this SO question 发现:

File Upload control

Additionally, the “Include local directory path when uploading files” URLAction has been set to "Disable" for the Internet Zone. This change prevents leakage of potentially sensitive local file-system information to the Internet. For instance, rather than submitting the full path C:\users\ericlaw\documents\secret\image.png, Internet Explorer 8 will now submit only the filename image.png.