File upload issues

[Merdok]

Hi Guys,

 

Can anyone see any issues with this code:

$setImage= 'productimages/' . date(U) . $HTTP_POST_FILES['setImage']['name'][0];
copy($HTTP_POST_FILES['setImage']['tmp_name'][0], $setImage);

 

Its stripping the original file name (including the extension) fromt he end of the image and just giving it a unix timestamp for a name. Looking at the code I think I can see why its doing that but I can't see how to fix it.

 

Any help would be most appreciated

[Merdok]

Here is the full code for the page, it has been slightly modified since my original post, the main problem seems to be that the file is not being uploaded.

 

<?php require_once('../../templates/standard/socket_header.php'); ?>
                   <p class="float_right button"> <a href="<?php echo $siteroot?>/socket/index.php">Discard</a></p> <h1> Add Set </h1>
          <p>From here you can add new Sets to your store</p>
          <?php
// checks to see if the form has already been submitted
if (!empty($_POST['submit'])) {
if (!empty($_FILES['setImageUpload'])) {
$setImageUpload= 'productimages/' . date(U) . $_FILES['setImageUpload']['name'][0];
move_uploaded_file($_FILES['setImageUpload']['tmp_name'][0], $setImageUpload);
}
// Gets the post data and puts it in variables.
$prodArray = serialize($_POST['prodArray']);
$setName = addslashes($_POST['setName']);
$catchline = addslashes($_POST['catchline']);
$setDesc = addslashes($_POST['setDesc']);
$brand = $_POST['brand'];
$setMaterial = $_POST['setMaterial'];
$setSize = addslashes($_POST['setSize']);
$specialOffer = $_POST['specialOffer'];
$soPrice = $_POST['soPrice'];
$catalogueNumber = addslashes($_POST['catalogueNumber']);
$setPrice = $_POST['setPrice'];
$setBase_postage = $_POST['setPostage'];
$tinytag = random_num();
$setTax = $_POST['setTax'];
$setStock = $_POST['setStock'];
$despatch_time = $_POST['despatch_time'];



if (empty($_POST['setName']) || empty($_POST['setDesc']) || empty($_POST['setPrice']) || empty($_POST['setPostage']) || empty($_POST['setTax']) || empty($_POST['setStock']) || empty($_POST['despatch_time'])) {

$message = '<strong><p class="error">Please complete all required fields! (*)</p></strong>';
} else {


$dbinsert = "INSERT INTO bolt_shop_set (prodArray, name, catchline, description, special_offer, so_price, catalogueno, price, image, base_postage, tax, tinytag, stock, despatch_time) VALUES ('$prodArray', '$setName', '$catchline', '$setDesc', '$specialOffer', '$soPrice', '$catalogueNumber', '$setPrice', '$setImageUpload', '$setBase_postage', '$setTax', '$tinytag', '$setStock', '$despatch_time')";
$posted = mysql_query($dbinsert) or die($message = '<h3 style="color:red"> Insertion Failed! </h3>' . mysql_error());;
}

if ($posted) {
$message = '<strong><p class="success">Set added</p></strong>';
}
} ?>
          <?php echo $message; ?>
          <form enctype="multipart/form-data" action="admin_shop_set_add.php" method="post">
             <div id="addprodbox">
               <select id="prodArray[]" name="prodArray[]">
                 <?php 
$prodlookup = "SELECT prodID, name FROM bolt_shop_prod";
$proddata = mysql_query($prodlookup) or die('Failed to return data: ' . mysql_error());
while($option = mysql_fetch_array($proddata)) {
  echo '<option value="' . $option['prodID']. '">' .$option['name'].'</option>';
  } ?>
    </select>
               </div>  <a class="button float_right" href="javascript:void( 0 );" id="addanother">add another</a>
                            <p>
              <label>Catalogue Number<br />
                <input name="catalogueNumber" type="text" id="catalogueNumber" size="50" value="">
              </label>
            </p> 
             <p>
              <label>Set Name<br />
                <input name="setName" type="text" id="setName" size="50" value="">
              </label>
            </p>             <p>
              <label>Catchline (A short line of text to give you an extra sales comment (eg: 'Special offer for this week only'))<br />
                <input name="catchline" type="text" id="catchline" size="50" value="">
              </label>
            </p>
                    <p>
              <label>Set Image<br />
				<input name="setImageUpload" type="file" id="setImageUpload" size="50" value="setImageUpload">
              </label>
            </p>

            <p>
              <label>Price (£)<br />
                <input name="setPrice" type="text" id="setPrice" size="20" value="">
              </label>
            </p>
            <p>
              <label>Base Postage (£)<br />
                <input name="setPostage" type="text" id="setPostage" size="20" value="">
              </label>
            </p>
            <p>
              <label>Includes Tax?<br />
                <input name="setTax" type="radio" checked="checked" value="no" /> <span> No </span>
                <input name="setTax" type="radio" value="yes" /> <span> Yes </span>
              </label>
            </p>
            <p>
              <label>Product Description<br />
              <textarea class="mceAdvanced" name="setDesc" id="setDesc" cols="75" rows="20"></textarea>
              </label>
            </p>
            <p>
              <label>Initial Stock<br />
                <input name="setStock" type="text" id="setStock" size="10" value="">
              </label>
            </p>
                        <p>
              <label>Standard Despatch Time<br />
              <select name="despatch_time">
                <option value="1">24 hours</option>
                <option value="2">48 Hours</option>
                <option value="3">1 Week</option>
                <option value="4">2 Weeks</option>
                <option value="5">1 Month</option>
                <option value="6">Awaiting stock</option>
              </select>
              </label>
            </p>
          <input name="submit" type="submit" value="Submit">
          </form>
          
<?php require_once('../../templates/standard/socket_footer.php'); ?>

[PFMaBiSmAd]

See this link - http://www.php.net/manual/en/features.file-upload.errors.php

And this one - http://www.php.net/manual/en/ini.core.php#ini.post-max-size

 

ALL CODE that is responsible for processing user supplied data must check for all possible errors and validate that data before blindly attempting to use that data.

 

Put some error checking logic into your code so that you know when the upload is failing.

 

When the size of the uploaded file exceeds the post_max_size setting, the $_FILES array is completely empty and you need to check for that condition as the first validation test. See the empty function.

 

You then need to check $_FILES['setImageUpload']['error'] for any errors, output a meaningful user message when there is an error and only process the uploaded file information where there is no upload error.

[Dorky]

 

http://php.net/manual/en/function.empty.php

 

[Merdok]

After all that it was becuase I had an index on the end of the file which was making it into an array, removed the "[0]" and it just worked.

[Dorky]

After all that it was becuase I had an index on the end of the file which was making it into an array, removed the "[0]" and it just worked.

one time i fed my snake some beer.