完善代码  do_upload_new.php （用于实现防护) <?php include_once "functions.php"; if(___________)//如果不存在 session start_session($expires); if(! isset($_SESSION['username'])) { exit('您没有权限访问此页面'); } if (!isset($_POST['upload'])) { exit('请选择需要上传的文件'); } if($_POST['path'] != 'uploads' && $_POST['path'] != 'face')/*判断 路径变量*/ { exit('路径错误'); } $target_path = 'c:/uploads/' . $_POST['path'];/*设置非 web 目录保存 文件*/ $uploaded_name = $_FILES['file']['name']; /*上传文件名*/ $temp = explode(".", $uploaded_name);/*以’.’为分隔符将字符串打散 为数组*/ $uploaded_type = ______; //end 函数获取文件后缀 $uploaded_size = $_FILES['file'][____];//$_FILES 函数获取文件大小 if($uploaded_size > 1000000) { exit('文件超过 1M 字节，上传失败'); } if(_________________________________/*strtolower()处理文件后缀*/ _________________________________ _________________________________ ) { exit('文件类型错误，上传失败'); } $fname = md5( time() . $uploaded_name ) . '.' . $uploaded_type;/* 对文件名进行 md5()处理，文件重命名*/ $target_path = $target_path . '/' . ________;//文件名 while(true) { if(!file_exists($target_path)) break; else { $fname = md5( time() . $uploaded_name ) . '.' . $uploaded_type; $target_path = $target_path . '/' . $fname; } } if(!move_uploaded_file($_FILES['file']['tmp_name'], $target_path)) { echo '内部错误，上传失败'; } else { echo htmlspecialchars($uploaded_name) . ' 上传成功! 当前文件名 为' .$fname; } ?>

完善代码如下：

<?php
include_once "functions.php";
if(!session_id()) session_start(); //如果不存在 session，就开始一个新的 session
if(!isset($_SESSION['username'])) {
exit('您没有权限访问此页面');
}
if (!isset($_POST['upload'])) {
exit('请选择需要上传的文件');
}
if($_POST['path'] != 'uploads' && $_POST['path'] != 'face') {
exit('路径错误');
}

$target_path = 'c:/uploads/' . $_POST['path']; //设置非 web 目录保存文件
$uploaded_name = $_FILES['file']['name']; //获取上传文件名
$temp = explode(".", $uploaded_name); //以’.’为分隔符将字符串打散为数组
$uploaded_type = end($temp); //获取文件后缀
$uploaded_size = $_FILES['file']['size']; //获取文件大小

if($uploaded_size > 1000000) {
exit('文件超过 1M 字节，上传失败');
}
if(strtolower($uploaded_type) != 'jpg' && strtolower($uploaded_type) != 'jpeg' && strtolower($uploaded_type) != 'png') { //判断文件类型是否为图片
exit('文件类型错误，上传失败');
}

$fname = md5(time() . $uploaded_name) . '.' . $uploaded_type; //对文件名进行 md5()处理，文件重命名
$target_path = $target_path . '/' . $fname; //设置完整文件路径

while(true) {
if(!file_exists($target_path)) break;
else {
$fname = md5(time() . $uploaded_name) . '.' . $uploaded_type;
$target_path = $target_path . '/' . $fname;
}
}

if(!move_uploaded_file($_FILES['file']['tmp_name'], $target_path)) {
echo '内部错误，上传失败';
} else {
echo htmlspecialchars($uploaded_name) . ' 上传成功! 当前文件名为' .$fname;
}
?>