PHP Security on Forms and DOM Manipulation
<p>I was having an interesting discussion with a fellow co-worker about security in PHP.</p>

<p>Let's say a person has a PHP site running with a standard HTML form. An attacked decides to use Chrome Developer tools and add in the DOM <code>enctype="multipart/form-data"</code> and a <code>file input</code>. </p>

<p>The attacker uploads a file, it probably won't execute if it were a virus yet it's still using bandwidth/storage for that moment. Would the file go into the PHP <code>/tmp</code> directory just by doing this? Wouldn't this make every form some-what insecure as a user can upload a file in any form?</p>

<p>On a bigger scale what if 100,000 people added that to the DOM and uploaded a random gigabyte file? Wouldn't that temporarily make them hit their bandwidth and/or storage mark?</p>
