How to ensure the security of uploaded files

1. You cannot rely solely on the client Js for judgment and verification. You need to perform verification on the server;

2. Use a whitelist to control the types of files that can be uploaded. Be careful not to use a blacklist, which is easy to ignore or omit;

3. Check the size and path of the uploaded file;

4. Prohibit the upload of. htacess files and verify the content of the uploaded files. Sometimes, you cannot only judge magic num;

(Uploading the. htacess file will overwrite the previous permission control file. htacess in PHP with some configuration problems, resulting in the opening of the script execution permission)

5. The directory for uploading files cannot be configured by the service as a directory where scripts can be executed. (important)