Re: Security with Uploading CSV to update database

[dws]

... a script which can be used to browse for a CSV, upload it, and execute a mySQL update using it's contents.

Could you expand on this a bit? As stated, I can read this two ways^*. One is that the files being browsed for are on some local user's machine (e.g., using a file upload form), and that they're uploaded to a server where they're using to update a MySQL database. The other is that they're browsed from on the server, and are uploaded to a client workstation that has a MySQL database.

Assuming the former, you could use CGI.pm to handle a file upload, and then use TextCSV to pick it apart, loading it into MySQL. These are nicely separable problems.

The security problem you have to deal with is someone uploading bogus data. You can approach this either by restricting who can upload data (e.g., using the .htaccess method you propose), or by rigorous checking of the data before updating the database, or both.

^*Learning to read requirements in conflicting ways is a useful skill for staying out of trouble.

[jerrygarciuh]

Thanks for the reply dws. Your assumption is correct. One of the handlers of the main database will be exporting the csv's and then using my script to upload the file and execute the update.

Assuming that someone defeats the double password protection and attempts to upload bogus data, they will have to figure out how many fields there are (I do a check on the CSV data), an incorrect # of fields throws an error and a message like: "Error #553. Please contact Jerry Garciuh at Terrapin Station". What sort of more rigorous checking do you think should I employ?
Thanks again
jg
_____________________________________________________
Think a race on a horse on a ball with a fish! TG