使用文件名中的撇号上传文件

Question

I'm currently having a problem uploading files to the server that have an apostrophe in the file name. For example O'Connell.doc The form works perfectly when there is no apostrophe in the filename. I get a 500 Internal server error when an apostrophe is used. It gets to form.php?p=apply Seems like the form is submitted and then immediately fails. Any ideas where to look? Thanks!

Answer 1

It sounds like your form is vulnerable to a Code Injection attack. The apostrophe is being interpreted when the file is being processed and then you are getting some sort of error from that failure.

All user input needs to be sanitized to all interpreters that it will go through. The ideal is that user input is never interpreted, only stored or called. So rather than calling a shell on the input, use exec or something on the exact executable and arguments you want.