Re: File_Upload and Image_Upload

Bealers wrote: > > Hi there > > I've Pearified my File_Upload class and Abstracted out image uploading to a > separate class (as suggested by Hans) and I guess I need to know what > happens next RE: getting it commited. > [..] > > I'd appreciate any +ve or -ve feedback on the code as this is only my second > peice of any type of OO code and I'm not 100% sure that I extended > File_Upload (in Image_Upload) correctly (although it works) Anyway, it's > available @ http://bealers.com/php/File_Upload.zip > I don't feel very comfortable with this class. I'll explain why: - People would need to use printForm for building the form, so for example it can not be integrated with templates. - It relies in the information given from the form (easy to forge) rather than in Web server env vars. - It detect errors at "uploading" time, so you need to do the final upload to know if the file was an error or not. - It doesn't do needed checks about the destination dir or file, and won't return any information about the error if the destination is unusable. - It doesn't gives to the developer information about the uploaded file. - The idea of extending the upload class to treat some kind of files, seems for me far from the concept of "upload files". Also the API for extending is not very well defined as it needs to repeat almost all the code of the base class. - It doesn't provides a method to protect file names, so people could upload files with special formatted names that can open a security hole. - Perhaps I'm wrong, but I think that the mime type is sent by the browser, and as it could be forge, the system to deny certain files becomes very weak. - It hasn't good documentation and examples of use. I don't want to compare, but IMHO my Uploader (http://vulcanonet.com/soft/index.php?pack=uploader) provides more flexibility, security and documentation, and it is yet being used in production envs. Anyway I won't give my vote to add this class if errors aren't corrected. Tomas V.V.Cox