note 69120 rejected from features.file-upload by dmytton
| From: | dmytton@php.net | Date: | Tue, 06 Feb 2007 11:32:39 +0000 |
| Subject: | note 69120 rejected from features.file-upload by dmytton | ||
| References: | 1 | Groups: | php.notes |
| Request: | Send a blank email to php-notes+get-122914@lists.php.net to get a copy of this message | ||
Note Submitter: steve at averageguysteve dot com
----
Need some help. I'm really new to php, but I'm trying to setup an upload page. I ONLY
want images to be allowed to upload. I've used lots of script from this page already, and it
works great, but after reading some comments I want to be sure no one can upload a script with a
.jpg or .gif extension and cause any problems, however I can't figure out how to do that.
I've tried the getimagesize() and exif_imagetype() to verify that the file is truely an image,
but I can't get either to work due to my total lack of experience with php. I'm picking
it up quick (only second day using it) and know html and css very well. Below is my script, any
help to exactly what code and where to put it would be MUCH apprecaited. Thank you.
<?
$num_of_uploads=1;
$file_types_array=array("jpg","gif");
$max_file_size=110000;
$upload_dir="images_public/";
function uploaderFILES($num_of_uploads=1, $file_types_array=array("jpg","gif"),
$max_file_size=110000, $upload_dir="images_public/"){
if(!is_numeric($max_file_size)){
$max_file_size = 110000;
}
$size = getimagesize($filename);
$fp=fopen($filename, "rb");
if ($size && $fp) {
header("Content-type: {$size['mime']}");
fpassthru($fp);
exit;
} else {
// error
}
foreach($_FILES["file"]["error"] as $key => $value)
{
if($_FILES["file"]["name"][$key]!="")
{
if($value==UPLOAD_ERR_OK)
{
$origfilename = $_FILES["file"]["name"][$key];
$filename = explode(".", $_FILES["file"]["name"][$key]);
$filenameext = $filename[count($filename)-1];
unset($filename[count($filename)-1]);
$filename = implode(".", $filename);
$filename = substr($filename, 0, 15).".".$filenameext;
$file_ext_allow = FALSE;
if (file_exists('images_public/' . $filename)) {
// append a digit to the beginning of the name
$tmpVar = 1;
while(file_exists('images_public/' . $tmpVar . '-' . $filename)) {
// and keep increasing it until we have a unique name
$tmpVar++;
}
$filename= $tmpVar . '-' . $filename;
}
for($x=0;$x<count($file_types_array);$x++){
if($filenameext==$file_types_array[$x])
{
$file_ext_allow = TRUE;
}
} // for
if($file_ext_allow){
if($_FILES["file"]["size"][$key]<$max_file_size){
if(move_uploaded_file($_FILES["file"]["tmp_name"][$key],
$upload_dir.$filename)){
echo("<center>File uploaded successfully. Your image can be found at <a
href='".$upload_dir.$filename."'
target='_blank'>".$upload_dir.$filename."</a><br /><br
/><br /><img src='".$upload_dir.$filename."' border='0'
alt=''></center>");
}
else { echo('<center><font
color="#FF0000">'.$origfilename."</font> was not successfully
uploaded.<br /></center>");}
}
else { echo('<center><font
color="#FF0000">'.$origfilename."</font> was too big and was not
uploaded. Max file size is 100k!<br /></center>"); }
} // if
else{ echo('<center><font
color="#FF0000">'.$origfilename." </font>had an invalid file extension
and was not uploaded. Valid file types are .jpg or .gif.<br /></center>"); }
}
else{ echo('<center><font
color="#FF0000">'.$origfilename." </font>was not successfully
uploaded.<br /></center>"); } // else
}
}
}
?>
<?
if(isset($_POST["submitted"])){
uploaderFILES($num_of_uploads, $file_types_array, $max_file_size, $upload_dir);
}
?>
*had to trim down the html code, but it works.