I have file upload script as below (upload.php). As I can guess, someone can write script that sends 1000+ files to upload.php at the small period of time.
So, how to protect myself from numerous file uploads attack?
<?php
if (!empty($_FILES)) {
$ds = DIRECTORY_SEPARATOR;
$storeFolder = 'uploads';
$rand_dir = rand(1, 1000);
$targetPath = realpath(dirname(__FILE__) . '/..') . $ds . $storeFolder . $ds . $rand_dir . $ds;
$targetPath_clean = $storeFolder . $ds . $rand_dir . $ds;
if (!file_exists($targetPath))
mkdir($targetPath, 0777, true);
$filename = date('YmdHis_') . generateRandomString() . '.' . pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);
move_uploaded_file($_FILES['file']['tmp_name'], $targetPath . $filename);
echo $targetPath_clean . $filename;
} else {
die('access denied');
}
?>