title: Vulnerabilities in PHP Form Handling Script
body: <p>I'm writing a PHP script that takes input from a form, including uploads, and emails them to an administrator using Magento's mail client. I think I've covered the basics pretty well, but I'm sure I'm missing some potential vulnerabilities as I'm not a security expert.</p>
  
  <p>Can anyone point out some things that I might be overlooking here?</p>
  
  <pre><code>&lt;?php
  
  $maxfilesize = 1000;
  $maxStringLength = 50;
  
  if(isset($_POST['submit'])){
      $drivers_license = $_FILES['drivers-license'];
  
      $cfi_cert = $_FILES['cfi-cert'];
      $cfi_multiple = false;
      if(count($_FILES['cfi-cert']['name']) &gt; 1){
          if(count($_FILES['cfi-cert']['name']) &gt; 2){
              die('Invalid input')
          }
  
          $cfi_multiple = true;
  
          $cfi_cert1['name'] = $_FILES['cfi-cert']['name'][0];
          $cfi_cert1['type'] = $_FILES['cfi-cert']['type'][0];
          $cfi_cert1['tmp_name'] = $_FILES['cfi-cert']['tmp_name'][0];
          $cfi_cert1['error'] = $_FILES['cfi-cert']['error'][0];
          $cfi_cert1['size'] = $_FILES['cfi-cert']['size'][0];
  
          $cfi_cert2['name'] = $_FILES['cfi-cert']['name'][1];
          $cfi_cert2['type'] = $_FILES['cfi-cert']['type'][1];
          $cfi_cert2['tmp_name'] = $_FILES['cfi-cert']['tmp_name'][1];
          $cfi_cert2['error'] = $_FILES['cfi-cert']['error'][1];
          $cfi_cert2['size'] = $_FILES['cfi-cert']['size'][1];
      }
  
      //Remove special characters from text inputs
  
      $ftn = htmlspecialchars($_POST['ftn']);
      $phone = htmlspecialchars($_POST['phone']);
      $email = htmlspecialchars($_POST['email']);
  
      if(strlen($email) &gt; $maxStringLength || strlen($phone) &gt; $maxStringLength || strlen($ftn) &gt; $maxStringLength){
          die('Invalid input');
      }
  
      //Build attachments array, calling image validation function for each
  
      $attachments = array();
  
      imageValidationErrorCheck($drivers_license, $maxfilesize);
      $attachments[] = $drivers_license;
  
      if($cfi_multiple){
          imageValidationErrorCheck($cfi_cert1, $maxfilesize);
          $attachments[] = $cfi_cert1;
          imageValidationErrorCheck($cfi_cert2, $maxfilesize);
          $attachments[] = $cfi_cert2;
      } else {
          imageValidationErrorCheck($cfi_cert, $maxfilesize);
          $attachments[] = $cfi_cert;
      }
  
      //Use Magento's email client
  
      $mageFilename = '../app/Mage.php';
      require_once($mageFilename);
      Mage::app();
  
      $mailTemplate = Mage::getModel('core/email_template');
      $mailTemplate-&gt;setSenderName('Test Sender');
      $mailTemplate-&gt;setSenderEmail('testsender12345@test.com');
      $mailTemplate-&gt;setTemplateSubject('Processing');
  
      $output .= "Email Address:&lt;br&gt;";
      $output .= $email . "&lt;br&gt;&lt;br&gt;";
      $output .= "Phone Number:&lt;br&gt;";
      $output .= $phone . "&lt;br&gt;&lt;br&gt;";
      $output .= "FTN:&lt;br&gt;";
      $output .= $ftn . "&lt;br&gt;&lt;br&gt;";
  
      $mailTemplate-&gt;setTemplateText($output);
  
      foreach($attachments as $attachment){
          $mailTemplate-&gt;getMail()-&gt;createAttachment(
          file_get_contents($attachment['tmp_name']),
          Zend_Mime::TYPE_OCTETSTREAM,
          Zend_Mime::DISPOSITION_ATTACHMENT,
          Zend_Mime::ENCODING_BASE64,
          $attachment['name']
          );
      }
  
      $mailTemplate-&gt;send('testrecipient@test.com');
  }
  
  //Validate images
  
  function imageValidationErrorCheck($file, $maxSizeKb){
      $error = '';
      $baseName = basename($file['name']);
      $type = substr($baseName, strrpos($baseName, '.') + 1);
      $sizeInKb = $file['size'] / 1024;
  
      //Limit size to max file size
      if($sizeInKb &gt; $maxSizeKb){
          die('Invalid input');
      }
  
      //Check file extension
      $allowedExtensions = array("jpg", "jpeg", "gif", "bmp", "png", "tiff", "pdf", "doc", "docx");
      if(!in_array(strtolower($type), $allowedExtensions)){
          die('Invalid input');
      }
  }
  
  
  ?&gt;
  </code></pre>