title: Null byte injection in an upload form
body: <p>I'm trying to reproduce the Null Byte Injection attack on an upload form. I have this code:</p>
  
  <pre><code>&lt;?php
  if(substr($_FILES['file']['name'], -3) != "php") { 
    if(move_uploaded_file($_FILES['file']['tmp_name'], $_FILES['file']['name']))
      echo '&lt;b&gt;File uploaded&lt;/b&gt;';
    else
      echo '&lt;b&gt;Can not upload&lt;/b&gt;';
  }
  else
    echo '&lt;b&gt;This is not a valid file/b&gt;';
  ?&gt;
  </code></pre>
  
  <p>I'm trying to upload a file named like this : <em>file.php%00jpg</em> so it will bypass the substr() and will be uploaded as file.php since move_uploaded_file() should stop at the null byte (%00).<br /></p>
  
  <p>The problem is that the uploaded file is not named <em>file.php</em> on the server but <em>file.php%00jpg</em> (which can be accessed by typing <em>/file.php%2500jpg</em> in the url bar).<br />
  It seems that move_uploaded_file() does not care about the null byte, so how does this works? Is it possible to upload a file with .php extension with my piece of code?<br /></p>
  
  <p>Thanks :).</p>