我正在編寫腳本以將圖像上傳到我的應(yīng)用程序。以下安全步驟是否足以使應(yīng)用程序從腳本角度安全？使用.httaccess禁止PHP在上傳文件夾中運(yùn)行。如果文件名包含字符串“ php”，則不允許上傳。僅允許擴(kuò)展名：jpg，jpeg，gif和png。僅允許圖像文件類型。禁止使用兩種文件類型的圖像。更改圖像名稱。上載到不是根目錄的子目錄。這是我的腳本： $filename=$_FILES['my_files']['name']; $filetype=$_FILES['my_files']['type']; $filename = strtolower($filename); $filetype = strtolower($filetype); //check if contain php and kill it  $pos = strpos($filename,'php'); if(!($pos === false)) {  die('error'); } //get the file ext $file_ext = strrchr($filename, '.'); //check if its allowed or not $whitelist = array(".jpg",".jpeg",".gif",".png");  if (!(in_array($file_ext, $whitelist))) {    die('not allowed extension,please upload images only'); } //check upload type $pos = strpos($filetype,'image'); if($pos === false) {  die('error 1'); } $imageinfo = getimagesize($_FILES['my_files']['tmp_name']); if($imageinfo['mime'] != 'image/gif' && $imageinfo['mime'] != 'image/jpeg'&& $imageinfo['mime']      != 'image/jpg'&& $imageinfo['mime'] != 'image/png') {   die('error 2'); }//check double file type (image with comment)if(substr_count($filetype, '/')>1){die('error 3')} // upload to upload direcory  $uploaddir = 'upload/'.date("Y-m-d").'/' ;if (file_exists($uploaddir)) {  } else {      mkdir( $uploaddir, 0777);  }    //change the image name $uploadfile = $uploaddir . md5(basename($_FILES['my_files']['name'])).$file_ext;  if (move_uploaded_file($_FILES['my_files']['tmp_name'], $uploadfile)) { echo "<img id=\"upload_id\" src=\"".$uploadfile."\"><br />";  } else {   echo "error";  }歡迎任何新提示：）