note 69120 added to features.file-upload
| From: | steve at averageguysteve dot com | Date: | Wed, 23 Aug 2006 20:36:16 +0000 |
| Subject: | note 69120 added to features.file-upload | ||
| Groups: | php.notes | ||
| Request: | Send a blank email to php-notes+get-116238@lists.php.net to get a copy of this message | ||
Need some help. I'm really new to php, but I'm trying to setup an upload page. I ONLY
want images to be allowed to upload. I've used lots of script from this page already, and it
works great, but after reading some comments I want to be sure no one can upload a script with a
.jpg or .gif extension and cause any problems, however I can't figure out how to do that.
I've tried the getimagesize() and exif_imagetype() to verify that the file is truely an image,
but I can't get either to work due to my total lack of experience with php. I'm picking
it up quick (only second day using it) and know html and css very well. Below is my script, any
help to exactly what code and where to put it would be MUCH apprecaited. Thank you.
<?
$num_of_uploads=1;
$file_types_array=array("jpg","gif");
$max_file_size=110000;
$upload_dir="images_public/";
function uploaderFILES($num_of_uploads=1, $file_types_array=array("jpg","gif"),
$max_file_size=110000, $upload_dir="images_public/"){
if(!is_numeric($max_file_size)){
$max_file_size = 110000;
}
$size = getimagesize($filename);
$fp=fopen($filename, "rb");
if ($size && $fp) {
header("Content-type: {$size['mime']}");
fpassthru($fp);
exit;
} else {
// error
}
foreach($_FILES["file"]["error"] as $key => $value)
{
if($_FILES["file"]["name"][$key]!="")
{
if($value==UPLOAD_ERR_OK)
{
$origfilename = $_FILES["file"]["name"][$key];
$filename = explode(".", $_FILES["file"]["name"][$key]);
$filenameext = $filename[count($filename)-1];
unset($filename[count($filename)-1]);
$filename = implode(".", $filename);
$filename = substr($filename, 0, 15).".".$filenameext;
$file_ext_allow = FALSE;
if (file_exists('images_public/' . $filename)) {
// append a digit to the beginning of the name
$tmpVar = 1;
while(file_exists('images_public/' . $tmpVar . '-' . $filename)) {
// and keep increasing it until we have a unique name
$tmpVar++;
}
$filename= $tmpVar . '-' . $filename;
}
for($x=0;$x<count($file_types_array);$x++){
if($filenameext==$file_types_array[$x])
{
$file_ext_allow = TRUE;
}
} // for
if($file_ext_allow){
if($_FILES["file"]["size"][$key]<$max_file_size){
if(move_uploaded_file($_FILES["file"]["tmp_name"][$key],
$upload_dir.$filename)){
echo("<center>File uploaded successfully. Your image can be found at <a
href='".$upload_dir.$filename."'
target='_blank'>".$upload_dir.$filename."</a><br /><br
/><br /><img src='".$upload_dir.$filename."' border='0'
alt=''></center>");
}
else { echo('<center><font
color="#FF0000">'.$origfilename."</font> was not successfully
uploaded.<br /></center>");}
}
else { echo('<center><font
color="#FF0000">'.$origfilename."</font> was too big and was not
uploaded. Max file size is 100k!<br /></center>"); }
} // if
else{ echo('<center><font
color="#FF0000">'.$origfilename." </font>had an invalid file extension
and was not uploaded. Valid file types are .jpg or .gif.<br /></center>"); }
}
else{ echo('<center><font
color="#FF0000">'.$origfilename." </font>was not successfully
uploaded.<br /></center>"); } // else
}
}
}
?>
<?
if(isset($_POST["submitted"])){
uploaderFILES($num_of_uploads, $file_types_array, $max_file_size, $upload_dir);
}
?>
*had to trim down the html code, but it works.
----
Server IP: 64.71.164.2
Probable Submitter: 64.2.208.52
----
X-Spam-Status: No, hits=3.4 required=5.0 tests=DATE_MISSING,FROM_NO_LOWER,
HTML_FONTCOLOR_UNKNOWN,HTML_MESSAGE autolearn=no version=2.64
----
Manual Page -- http://www.php.net/manual/en/features.file-upload.php
Edit -- https://master.php.net/note/edit/69120
Del: integrated -- https://master.php.net/note/delete/69120/integrated
Del: useless -- https://master.php.net/note/delete/69120/useless
Del: bad code -- https://master.php.net/note/delete/69120/bad+code
Del: spam -- https://master.php.net/note/delete/69120/spam
Del: non-english -- https://master.php.net/note/delete/69120/non-english
Del: in docs -- https://master.php.net/note/delete/69120/in+docs
Del: other reasons-- https://master.php.net/note/delete/69120
Reject -- https://master.php.net/note/reject/69120
Search -- https://master.php.net/manage/user-notes.php