Random name for File Upload needed?

[the_nerd]

I've been using something like the code snippet below for quite a while, no problems. But: Now I have to do a site that accepts thousands of upload daily and I'm not sure if
<input name="userfile" type="file">
is ok, or if I have to generate a random name instead of the fixed string "userfile".

Why? When processing the uploaded file I refer to it with something like $_FILES['userfile']['tmp_name']

Now, if two persons upload a file at the same time, would using 'userfile' for both be a problem or will the "system" take care of that?

Thanks for any insight,

Nerd.

<form enctype="multipart/form-data" action="_URL_" method="post">
<input type="hidden" name="MAX_FILE_SIZE" value="30000">
Send this file: <input name="userfile" type="file">
<input type="submit" value="Send File">
</form>

[dreamcatcher]

You can generate a random string and then attach it to the file name.

This little snippet was posted a while back and will do just fine:

$prefix = substr ( md5(uniqid(rand(),1)), 3, 10);

When you process the upload add the prefix to the file name:

if (is_uploaded_file($_FILES['userfile']['tmp_name']))
{
move_uploaded_file($_FILES['userfile']['tmp_name'],'uploads/' . $prefix . "_" . $_FILES['userfile']['name']);
}

or something like that.

dc

[the_nerd]

Thanks, dreamcatcher!

But I was wondering if I already have to use a unique name when UPLOADING (not when moving the uploaded file, that's understood. Thanks for the md5-hack!)

e.g.
Send this file:
<input name="userfilee343r" type="file">
<input type = "hidden" name = "myname" value = "userfilee343r">

next time e.g.

Send this file:
<input name="userfileZ1221" type="file">
<input type = "hidden" name = "myname" value = "userfileZ1221">

and so on.

This way I could after POST

get the name ($_POST['myname'])
and then
$_FILES [$_POST['myname']] ['tmp_name']

to retrieve the uploaded file. But after a couple hours of sleep I guess that's just unneccessary complication. because every user has his own "$_FILES", right?

Nerd.

[the_nerd]

Unique?

prefix = substr ( md5(uniqid(rand(),1)), 3, 10);

I didn't find the original post, but I'm not sure if "prefix" can give me any "security":

md5 is thought to be collision-free, i.e. the probability of finding two string that will result in the same md5-value is rather low.

But arbitrarily picking 10 bytes out of a hash-string? As for as I know, nothing has ever been said about substrings of hash-values when it comes to collisions.

Is there a restriction in the length of filename? If not md5("timestamp" + "ip") should give me something rather unique.

Nerd

[dreamcatcher]

Personally, I would check to see if the file exists using file_exists() and if it does then go about adding prefixes to file names.

The chances of the $prefix code generating the same string would be highly unlikely, but a timestamp would also be a good idea as it changes every second.

dc