Can SQL injection be achieved through $_FILES variables?

I'm just going through a current project adding the necessary code to prevent SQL injection, XSS etc. However I was wondering how easy it would be to execute SQL injection via a file upl开发者_如何学Coad?

Does any one have any knowledge in this area?

---

You should sanitize any user-supplied input. This includes $_FILES. For example, if you store the uploaded filename in a database, this could be exploited by an attacker.

---

This has been answered correctly by qbert220 but I wanted to add an additional note.

You should ensure that the file is the correct MIME type, otherwise if your expecting an image to be uploaded and then displayed, if "nasty user" uploads a php script it could be ran on your server and do whatever you could do with the script.

---

It depends on your application needs. If you are doing an image gallery and want to tag uploaded images, you may want to add the data for the images to the database. For this, you may need to put in the database the contents of $_FILES['image']['name'], then a SQL injection it's possible if you don't escape its value.

---

it can be done if you're for example inserting filename into DB.

mysql_query("INSERT INTO images VALUES ('".$_FILES['upload']['name']."');"); //this is injectable

---

Never think if given input can be used for SQL injection, escape any variable that is send to the database. Same applies for XSS when you are outputing variable. Do not trust $_SERVER or any other superglobal. Do not trust your variables as well (those initialized in the code).