Re: Problems with Form POSTing to PHP script

From: Date: Sun, 11 May 2003 00:52:27 +0000
Subject: Re: Problems with Form POSTing to PHP script
References: 1  Groups: php.general 
Request: Send a blank email to php-general+get-147176@lists.php.net to get a copy of this message
> $doc = $HTTP_POST_VARS["File"]; Assuming this is an UPLOADED document, it won't be in with the POST vars. It will be handled separately, in $_FILES[] array. See http://php.net/ and dig around for "Handling File Upload" Be SURE you have that Encoding and multipart/form-data stuff in the FORM tag. Gets me every time. :-) > if ($doc) > { > copy ($doc, "/tmp/$doc.tmp"); Use the new-fangled copy_uploaded_file instead for additional security. Use the return value to generate an error if PHP was UNABLE to copy the file. (EG, /tmp/ is not writable by PHP user?) > $document = "/tmp/$doc.tmp"; It would probably be better to set this in the line above, and use $document in the copy() so that there is no chance only one of the two lines gets changed by tomorrow's patch. :-P > unlink ($File); There is no $File. And even if there was, you probably should not unlink it at this point... A) You haven't sent the fax yet. B) PHP is going to unlink the original when the script ends anyway. > $command = $prog."-n -f $email -d $fax_num $doc"; By this point, you want $document anyway, not $doc, right? Once you've moved it, that's the one you want to fax. That said, if the HylaFax thingie is going to do the fax IMMEDIATELY, without any delay, and you are finished with the document after the next line (more on that later) then why move the file at all?... And, finally, you *REALLY* should do some testing on the uploaded file to make sure it's, like, not some kind of trojan hack. Are they supposed to be all text? All Word docs? What? Under XXXK? *ANY* kind of sanity checks to be sure the uploaded file coming from untrusted users you can come up with are a boon. The more, the better. > system($command); You should probably be using exec() and checking the return code so that when, not if, when, HylaFax pukes on your pretty blue suede shoes, you can do something intelligent about it. I'm also betting that you could program HylaFax to send the SAME fax to a bunch of numbers at once, rather than firing up another copy of HylaFax for every single recipient. This will drastically improve performance, if HylaFax lets you do that. > $i++; > } > > mysql_close; Que? mysql_close(); ? Don't even bother. PHP will close it when the script ends anyway. And in a very ancient version of PHP, this had a bug anyway :-) > > system("$rm $document"); Don't fork (use system()) to remove a file. Use http://php.net/unlink Of course, this file may not even need to have been created in the first place, as noted above. > echo "Successfully sent $i faxes"; The logic here would change, of course, with the multi-recipient faxing.

« previous php.general (#147176) next »