title: How can I secure use of fopen on a CSV file?
body: <p>I have a PHP script which allows a user to upload a CSV, and then make some changes via an API.</p>
  
  <p>I use fopen to open and access the file after it's been uploaded. I check for size, name, presence of known bad extensions etc using the <code>$_FILES</code> array on upload.</p>
  
  <p>The data is simply a grid of ID's and corresponding action codes.</p>
  
  <p>It's a closed group of users, and nothing is being include)()'ed or require()'d from this input but I am still concerned that by manipulating the upload something bad can happen.</p>
  
  <pre><code>if (($han = fopen($fileloc, "r")) !== false) {
              while (($data = fgetcsv($han, 50, ",")) !== false) {
              array_push($stack, $data); //
              }
              fclose($han);
              }
  </code></pre>