Upload Image Problem

[ded]

I am allowing the a user to edit calendar information.  Part of the edit is to add/change a flyer associated to information.  I keep getting the "Possible file upload attack" error.

 

Here is the coding...............

 

<?php 
.......
echo "<form action=\"postedit.php?rrn=$rrn\" method=\"post\">";
.......
echo "<tr><td align=right valign=top>Flyer:</td><td align=left><input name=\"filename\" type=\"file\">";
echo "<br>Current File: " . substr($row['filename'], 13);
echo "</textarea></table><br>";
echo "<input type=\"submit\">";
echo "</form>";
} ?>

 

 

postedi.php code:

<?php $rrn = $_GET['rrn'];
......
if($_FILES['filename']['error'] != 4) {
$uploaddir = '../../flyers/';
$uploadfile = $uploaddir . basename($_FILES['filename']['name']);
echo '<pre>';
if (move_uploaded_file($_FILES['filename']['tmp_name'], $uploadfile)) {
echo "File is valid, and was successfully uploaded.\n";
} else {
echo "Possible file upload attack!\n";
}
print "</pre>";
}
......?>

 

Any ideas on why this will not load properly???

 

 

Regards,

DED

[BlueSkyIS]

try using an absolute path instead of a relative path. also make sure the upload directory is writable.

 

// relative path:
$uploaddir = '../../flyers/';

// absolute path
$uploaddir = '/home/websites/yourhome/public_html/flyers/';
//or
$uploaddir = $_SERVER['DOCUMENT_ROOT'].'/flyers/';

[PFMaBiSmAd]

Your form is missing an enctype parameter needed for uploads to work. I recommend reading this - http://www.php.net/manual/en/features.file-upload.php

[BlueSkyIS]

doh! good catch. 

[ded]

wow!.....did not realise that was missing....thank you.