Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

What is the correct way to allow users to upload images to a site? I'm using mod_php so everything is done by apache, not the domains user.

Right now I just chmod 777 the images folder and hope for the best :)

I've been looking at adding an .htaccess file to prevent PHP from running in that folder.

share|improve this question
add comment

2 Answers 2

up vote 0 down vote accepted

"I'm using mod_php so everything is done by apache, not the domains user."

I'd suggest stopping that right away; it's not healthy, even in a dedicated hosting environment (but is downright deadly if you've got more than one website on the box). suPHP works well enough for the task.

If your heart is set on sticking with mod_php, I would not recommend changing the user of the directory to match that of the webserver; this prevents effective administration of the site by the user who actually owns it. Instead, change the group of the directory to be that of the webserver, and then give that group write permission to the directory.

share|improve this answer
add comment

Ideally, you'd chown a folder to the user account running Apache. This might be 'apache' or 'www-data' or something else, depending on your environment. If the folder is chown'd by that user, you'd only need a permission of 700.

You might also want to check the file upload path in your php.ini file. It may upload the file with a unique filename into /tmp/ and then you'd use move_uploaded_file() to move the image to your 'images' folder.

As far as the .htaccess is concerned, you could also just write a simple index.php script that redirects to some other page on the site, like:

<?php
header("Location: /") ;
?>

So if someone tries to view yourdomain.com/images/ it'll just bounce them back to yourdomain.com

share|improve this answer
    
Setting the folder to be owned by apache sounds good. –  Slashterix Jul 8 '11 at 0:02
    
I'm afraid someone will find a way to upload their own PHP file and run it. You don't need to use an index.php since you can just Options -Indexes to disable directory listing. –  Slashterix Jul 8 '11 at 0:03
    
The only way they could upload a file to your system is via FTP or by POST'ing it to a form on your site. Either way, your hosting environment should protect you from malicious users. –  iandouglas Jul 8 '11 at 0:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.