php - secure way to upload text and image in php

Question

Just want to check how vulnerable are my scripts and projects. From the research of expert's blog and answer, I found possible attack and injection is based on

• file types
• sql statements
• access to image folder in root,
• session

I heard about Anti-CSRF token to prevent session hijacking. How can I pass CSRF token value from ajax form data.

I am not sure how much I am secure. Please guide me what I have to add in following scripts to improve security?

<?php
    if(!empty($_POST['heading']) && !empty($_POST['content']) && !empty($_POST['keytag']) && !empty($_POST['date'])){
        $query = '';
        if(!empty($_FILES['file']['name'])){
            $target_dir = "../images/news/";
            $img = basename($_FILES['file']['name']);
            $verifyimg = getimagesize($_FILES['file']['tmp_name']);
            $imageFileType = strtolower(pathinfo($img,PATHINFO_EXTENSION));
            $img_ext = end((explode('.', $img)));
            if($_FILES['file']['size'] > 200000){
                echo "File is too large";
                exit();
            }
            if($imageFileType != "jpg" && $imageFileType != "png" && $imageFileType != "jpeg" && $imageFileType != "gif" ) {
                echo "Only jpg/png/gif image !";
                exit();
            }
            if($verifyimg['mime'] != 'image/png' && $verifyimg['mime'] != 'image/jpg' && $verifyimg['mime'] != 'image/jpeg' && $verifyimg['mime'] != 'image/gif') {
                echo "Image is not valid";
                exit;
            }
            else{
                $new_img = substr(md5(time()), 0, 10) . '.' . $img_ext;
                $target_file = $target_dir .$new_img;
                move_uploaded_file($_FILES["file"]["tmp_name"], $target_file);
                $query = $con->prepare('INSERT into news(heading, content, keytag, date, img) VALUES(:heading, :content, :keytag, :date, :new_img)');
                $query->bindParam(':new_img',$new_img);

            }
        }
        if(empty($_FILES['file']['name'])){
            $query = $con->prepare('INSERT into news(heading, content, keytag, date) VALUES(:heading, :content, :keytag, :date)');
        }
        $query->bindParam(':heading', $_POST['heading']);
        $query->bindParam(':content', $_POST['content']);
        $query->bindParam(':keytag', $_POST['keytag']);
        $query->bindParam(':date', $_POST['date']);
        if($query->execute()){
            echo "Successfully Inserted";
        };
    }
?>

.htaccess

To block direct access

RewriteEngine on
RewriteCond %{HTTP_REFERER} !^http://www\.your-domain\.com/.*$ [NC]
RewriteCond %{HTTP_REFERER} !^http://www\.your-domain\.com$ [NC]
RewriteRule .*\.(wav|swf|jpg|jpeg|gif|png|bmp|js|css)$ - [F,NC,L]

My main question is how to pass CSRF Token from ajax ?

html

<input type="hidden" name="_token"  value="<?php echo $_SESSION['_token']; ?>" />
<input type="submit" value="Upload" />

Ajax

<script>
    $(document).on('submit', '#form', function(e){
        e.preventDefault();
        $.ajax({
            type: 'POST',
            url: 'upload.php',
            data: new FormData(this),
            contentType: false,
            cache: false,
            processData:false,
            success: function(data){
                alert(data);
            }
        });
    });
        $("#file").change(function(){
            var file = this.files[0];
            var imagefile = file.type;
            var match= ["image/jpeg","image/png","image/jpg"];
            if(!((imagefile==match[0]) || (imagefile==match[1]) || (imagefile==match[2]))){
                alert('Please select a valid image file (JPEG/JPG/PNG).');
                $("#file").val('');
                return false;
            }
    });
</script>

标签： phpajaxpdocsrfsql-injection