title: Upload File Issue - Refactor code to not construct the path from tainted, user-controlled data
body: <p>I'm using a normal code to upload a file but when I use the function <code>move_uploaded_file</code> it shows me the error in the image.</p>
  <p><a href="https://i.stack.imgur.com/CRbjf.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/CRbjf.png" alt="error screenshot" /></a></p>
  <ol>
  <li>Point #1 says: This value can be controlled by the user.</li>
  <li>Point #2 says: Taint value is propagated</li>
  <li>Point #3 says: taint value is used to perform a security-sensitive
  operation</li>
  </ol>
  <p>See my code:</p>
  <pre class="lang-php prettyprint-override"><code>if (!empty($_FILES[&quot;attachment&quot;][&quot;name&quot;]) || strpos($file_name, '../') !== true) {
    $uploadStatus = 1;
    $files_folder = 'files';
    $target_dir = dirname(__FILE__).'/'.$files_folder.'/';
    $fileName = basename($_FILES[&quot;attachment&quot;][&quot;name&quot;]);
    $targetFilePath = $target_dir . $fileName;
    $imageFileType = strtolower(pathinfo($targetFilePath, PATHINFO_EXTENSION));
    if($imageFileType != &quot;jpg&quot; &amp;&amp; $imageFileType != &quot;png&quot; &amp;&amp; $imageFileType != &quot;jpeg&quot; &amp;&amp; $imageFileType != &quot;gif&quot; &amp;&amp; $imageFileType != &quot;pdf&quot;) {
      $uploadStatus = 0;
      $img_status = 1;
    } else if (move_uploaded_file($_FILES['attachment']['tmp_name'], $targetFilePath)) {
        $uploadedFile = $targetFilePath;
    } else {
        $uploadStatus = 0;
    }
  }
  </code></pre>