I'm actually not too sure what effect the / or ; would have if the file name was something like the ones you suggested above. However, when the file gets to my server, I disregard the entire file name except for the extension (i.e, I extract the last three characters, and check to make sure they are either .jpg and .png) The rest of the file name is thrown away, and I generate a new random name, then append the extension that was extracted. But thank you, I will definitely be testing with names like this to see what happens.

How do you know the picture upload was the vulnerability here? Is there any other vector that could've been exploited from the obtained password? Is this password reused for other components of your system? FTP? DB?

As for logo.php/.jpg - windows doesn't allow such a file name? this statement implies some trust in the client again, as per Anders' answer - try and avoid this trust at all costs.

I can tell that the picture upload box was definitely the problem based on the file name of the PHP code that was uploaded. Example, I ended up with logo1234567.php (tells me it's coming from the File Upload box that handles logo pics When I store data from edit boxes, I use all three of PHP's functions to clean it: $cleanedName = strip_tags($_POST[name]); // Remove HTML tags $cleanedName = htmlspecialchars($cleanedName); // Allow special chars, but store them safely. $cleanedName = mysqli_real_escape_string($connectionName, $cleanedName);

FTP details are completely different to the password used to log onto the protected pages on the website. As are Database and Cpanel credentials. I've ensured that people can't even view the folder and file structure of the site. There is literally no way I can think of to rename a .jpg, or .png extension to .php on this site if you don't have FTP details.

You are validating client-side with Javascript code, which can be bypassed easily by the attacker by disabling Javascript/deleting that JS-code by pressing F12. Also, any chance you're running a Nginx server? If misconfigured .png images can be interpreted as PHP-code.

I'd also highlight it is probably pretty unlikely that a hacker accessed the page via a keylogger on a friend's computer. That would be a remarkably specific attack and your test site is unlikely to be a significant target. It is much more likely that there is another security issue that allowed access and a random vulnerability scanner found it and exploited it to post compromising code. These things literally scan the internet looking for places to put compromising code and exploit whatever they find, often completely automated. My web server has a few thousand such attempts a day.

there's no reason why you can't rename a file to change the extension, which is not a special part of the file at all but rather just some convention we've all come up with to determine what type of file it is based on just the name. in other words, I can write some PHP code in a text file and save it as "cooldog.jpg" but that doesn't mean it's not a text file that contains PHP code.

Aside from all the other things people have told you... the login your friend uses to "give feedback" should never be the same login that gives access to admin privileges...

the problem is probably how you deliver it - through a php script, you do like include("file.jpg"); right? that's bad bad bad. use readfile(), not include/require. or better yet, use x-accel-redirect/x-sendfile , which scales much better than readfile() - when you use include/require, if there randomly happens to be a <= or <? or <?php in the image binary, it gets corrupted. and it uses a lot of cpu looking for executable code in the image. AND it allows hackers to hack you through image uploads.

After the upload, you can use something like the php function getimagesize() to verify that the file is actually an image. This info may also be helpful if you need to restrict the size of the image... too small or too large... example: Images are required to be 64 x 64 pixels or larger (max 1280 x 1280).

Is the login system JavaScript based too?

its 2017 why are you still using FTP ?

Just need to check: is the login for your administration pages handled in javascript as well?

Is eval function enabled on the system ?

@exussum - how would you transfer your source code from your personal PC to the web server if not by FTP? SCP could be an alternative however FTP seems like the most obvious and common method.

FTP is fine if your happy sending plain text passwords. Anything over ssh (scp, git, rsync) are great alternatives