[SOLVED] Whats wrong with this upload script?

[andrewgarn]

The upload works find in firefox, but in ie it always gives the error "Only gif, jpeg can be uploaded" whether the file type is one of those or not

 

Html page:

<h2><img src="upload.png" alt="upload" width="400" height="60" /></h2>
Select an image to upload:<br>

<form action="uploader.php" method="post" enctype="multipart/form-data">
<input type="file" name="file" size="40"><br>
Enter Description: <br><input type="text" name="notes" VALUE="" SIZE="40"><br><br>										
<input type="submit" value="Upload File">
</form>

 

if( $_FILES['file']['name'] != "" )
{
if (($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/jpg")
|| ($_FILES["file"]["type"] == "image/png"))
{
	copy ( $_FILES['file']['tmp_name'],
	"gallery/" . $_FILES['file']['name'] )
	or die ( "Could not copy file" );
	$filename = $_FILES['file']['name'];
	echo $filename;
	$query = "INSERT INTO photo (uploader, filename, notes) VALUES ('$uploader', '$filename', '$description');";
	//echo $query;
	$result = mysql_query($query) or die(mysql_error());
}
else {
	die ( "Only gif, jpeg can be uploaded" );
}
}	

 

oh and thanks for looking

[rhodesa]

what happens when you use this for your die:

		die ( "Only gif, jpeg can be uploaded. You supplied: ".$_FILES["file"]["type"] );

 

Also, please post your HTML from the form

[andrewgarn]

what happens when you use this for your die:

		die ( "Only gif, jpeg can be uploaded. You supplied: ".$_FILES["file"]["type"] );

 

Also, please post your HTML from the form

 

It says this:

 

Only gif, jpeg can be uploaded. You supplied: image/pjpeg

 

But the file i'm uploading is definitely a .jpg

[rhodesa]

It's a 'progressive jpeg'. Firefox doesn't support them, therefore won't send that content-type (it just sends them as normal jpeg). It should be fine to add it to your allowed list. May I also recommend cleaning up your code a little with an array:

 

if( $_FILES['file']['name'] != "" )
{
$allowed = array(
	"image/gif",
	"image/jpeg",
	"image/pjpeg",
	"image/jpg",
	"image/png",
);
if (in_array($_FILES["file"]["type"],$allowed))
{

[andrewgarn]

Thank you, that worked.

 

are there any other types like that I should be aware of?

 

and thank you for the code cleanup

[rhodesa]

hum...not off the top of my head, but if you have GD enabled, you can use the getimagesize() function to test if it's an image. Just make sure you block errors with an @:

 

if(@getimagesize($_FILES['file']['tmp_name'])){

 

[andrewgarn]

Thanks