Uploading Files

ad_williams · December 11, 2009

Well im trying to make a code that will upload images onto my web hosting - ive seen some simple ones on the internet but i need mine to be only accept images..

Here is what ive come up with so far, but it doesnt seem to work. Could someone be so kind and tell me where ive gone wrong + where i can find all the image file types like "image/jpeg" etc.

Thanks

<?php

if (((($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/pjpeg")
|| ($_FILES["file"]["type"] == "image/png"))
//&& ($_FILES["file"]["size"] < 900000000)
&& ($ext == "jpg" || "png" || "gif"))
  
if ($_FILES["file"]["error"] > 0)
    {
    echo "Return Code: " . $_FILES["file"]["error"] . "<br />";
    }
  else
    {
    echo "Upload: " . $_FILES["file"]["name"] . "<br />";
    echo "Type: " . $_FILES["file"]["type"] . "<br />";
    echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
    echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />";

    if (file_exists("upload/" . $_FILES["file"]["name"]))
      {
      echo $_FILES["file"]["name"] . " already exists. ";
      }
    else
      {
      move_uploaded_file($_FILES["file"]["tmp_name"],
      "upload/" . $_FILES["file"]["name"]);
echo "Stored in: " . "images/imageuploads/" . $_FILES["file"]["name"];
      }
    }
  }
else
  {
  echo "Invalid file";
  }
?>

Kieran Menor · December 11, 2009

You can't trust $_FILES["file"]["type"] to actually tell the correct filetype as this is provided by the client's browser. Instead look up the getimagesize() function. It also provides info on the file type.

ad_williams · December 11, 2009

ok thanks will do - when i try that code out it says there is an error in the 2nd IF statement, could someone check that out please.

ignace · December 11, 2009

Try:

$imageSize = getimagesize($tmp_name); // $tmp_name = $_FILES['attribute-name']['tmp_name']
if (preg_match('/image\/(jpg|jpeg|gif|png)/', $imageSize['mime'])) {
  // your cool stuff here
}

mrMarcus · December 11, 2009

here is a fairly large list with many different mime types.

link: Array of MIME Types

right off the bat i can see that you're missing a closing ) and you have one too many }:

<?php

if (((($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/pjpeg")
|| ($_FILES["file"]["type"] == "image/png"))
//&& ($_FILES["file"]["size"] < 900000000)
&& ($ext == "jpg" || "png" || "gif")) //<---need one more ) here
  
if ($_FILES["file"]["error"] > 0)
    {
    echo "Return Code: " . $_FILES["file"]["error"] . "<br />";
    }
  else
    {
    echo "Upload: " . $_FILES["file"]["name"] . "<br />";
    echo "Type: " . $_FILES["file"]["type"] . "<br />";
    echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
    echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />";

    if (file_exists("upload/" . $_FILES["file"]["name"]))
      {
      echo $_FILES["file"]["name"] . " already exists. ";
      }
    else
      {
      move_uploaded_file($_FILES["file"]["tmp_name"],
      "upload/" . $_FILES["file"]["name"]);
echo "Stored in: " . "images/imageuploads/" . $_FILES["file"]["name"];
      }
    }
  } //<---one too many } .. remove this one
else
  {
  echo "Invalid file";
  }
?>

you need to either turn error_reporting on in your php.ini file (if you have access to it), as well as "display_errors", or add this to the top of your script(s), immediately following the first <?php:

<?php
ini_set ('display_errors', 1);
error_reporting (E_ALL);

this will help you to find any errors that might be happening.

and in the future, you need to give more information about what the problems are. "but it doesnt seem to work." will not suffice. i can't work with that. next time you bring your car into the shop, tell the mechanic, "it doesnt seem to work.", and see what he says.

and, instead of checking the $_FILES['type'], use getimagesize:

<?php
//allowed image mime types;
$allowed_filetypes = array ('image/jpeg', 'image/gif', 'image/png'); //and so on...

$image = getimagesize ($_FILES['file']['tmp_name']);
if (in_array ($image['mime'], $allowed_filetypes))
{
     //correct mime type .. file is ok.  continue doing stuff (more error handling, etc.);
}
else
{
     //incorrect mime type .. something is fishy;
}
?>

this is a much better check than just checking the file extension.

EDIT: ignace posted a cleaner check:

if (preg_match('/image\/(jpg|jpeg|gif|png)/', $image['mime']))

ad_williams · December 11, 2009

so

$imageSize = getimagesize($tmp_name); // $tmp_name = $_FILES['attribute-name']['tmp_name']
if (preg_match('/image\/(jpg|jpeg|gif|png)/', $imageSize['mime'])) {  // your cool stuff here
}

what does that replace - sorry but im abit of a php newbie

@mrMarcus thanks for the Array of MIME types.

ignace · December 11, 2009

About this:

((($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/pjpeg")
|| ($_FILES["file"]["type"] == "image/png"))
//&& ($_FILES["file"]["size"] < 900000000)
&& ($ext == "jpg" || "png" || "gif")

ad_williams · December 11, 2009

right ive added on that image thing.

<?php
ini_set ('display_errors', 1);
error_reporting (E_ALL);

$imageSize = getimagesize($tmp_name); // $tmp_name = $_FILES['attribute-name']['tmp_name']
if (preg_match('/image\/(jpg|jpeg|gif|png)/', $imageSize['mime'])) {  // your cool stuff here
(((($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/pjpeg")
|| ($_FILES["file"]["type"] == "image/png"))
//&& ($_FILES["file"]["size"] < 99999999)))
&& ($ext == "jpg" || "png" || "gif")))
}
if ($_FILES["file"]["error"] > 0)
    {
    echo "Return Code: " . $_FILES["file"]["error"] . "<br />";
    }
  else
    {
    echo "Upload: " . $_FILES["file"]["name"] . "<br />";
    echo "Type: " . $_FILES["file"]["type"] . "<br />";
    echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
    echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />";

    if (file_exists("upload/" . $_FILES["file"]["name"]))
      {
      echo $_FILES["file"]["name"] . " already exists. ";
      }
    else
      {
      move_uploaded_file($_FILES["file"]["tmp_name"],
      "image/imageuploads/" . $_FILES["file"]["name"]);
	echo "Stored in: " . "images/imageuploads/" . $_FILES["file"]["name"];
      }
    }
else
  {
  echo "Invalid file";
  }
?>

and it comes up with this error

Parse error: syntax error, unexpected T_IF in /***/******/************/uploading.php on line 13

ignace · December 11, 2009

Drop the whole ((()()()()((()(((()))) thing it makes your code unreadable anyway

$f = $_FILES['file'];
$imageSize = getimagesize($f['tmp_name']);
if (preg_match('/image\/(jpg|jpeg|gif|png)/', $imageSize['mime'])) {
    if (UPLOAD_ERR_OK !== $f['error']) {
        echo "Return Code: "

Additionally you could do:

function isValidImage($imagePath) {
    $imageSize = getimagesize($imagePath);
    return preg_match('/image\/(jpg|jpeg|gif|png)/', $imageSize['mime']);
}

Then you can use:

$f = $_FILES['file'];
if (isValidImage($f['tmp_name'])) {

ad_williams · December 11, 2009

does that replace the whole code or just a section??

ignace · December 12, 2009

<?php

function isValidImage($imagePath) {
    $imageSize = getimagesize($imagePath);
    return preg_match('/image\/(jpg|jpeg|gif|png)/', $imageSize['mime']);
}

function formatBytes($bytes) {
    $abbr = array('KB', 'MB', 'GB', 'TB');
    while ($bytes > 1024 && next($abbr)) {
        $bytes /= 1024;
    }
    return $bytes . ' ' . current($abbr);
}

$f = $_FILES['file'];
if (isValidImage($f['tmp_name'])) {
    if (UPLOAD_ERR_OK !== $f['error']) {
        echo 'Return Code: ' . $f['error'] . '<br />';
    } else {
        echo 'Upload: ' . $f['name'] . '<br />';
        echo 'Type: ' . $f['type'] . '<br />';
        echo 'Size: ' . formatBytes($f['size']) . '<br />';
        echo 'Temp file: ' . $f['tmp_name'] . '<br />';
        
        $filePath = implode(DIRECTORY_SEPARATOR, array('upload', $f['name']));
        if (file_exists($filePath)) {
            echo $f['name'] . " already exists. ";
        } else {
            if (move_uploaded_file($f['tmp_name'], $filePath)) {
                echo "Stored in: " . "images/imageuploads/" . $_FILES["file"]["name"];
            }
        }
    }
}
?>

ad_williams · December 12, 2009

it all works but it comes up with these two errors:

Warning: move_uploaded_file(upload/2nd Idea + border.png) [function.move-uploaded-file]: failed to open stream: No such file or directory in /****/********/public_html/uploading.php on line 28

Warning: move_uploaded_file() [function.move-uploaded-file]: Unable to move '/tmp/phprGOJ5i' to 'upload/2nd Idea + border.png' in /****/********/public_html/uploading.php on line 28

Hows do i fix them

ignace · December 12, 2009

Are you sure the directories exists and you have permission to create files?

ad_williams · December 12, 2009

yeah i can create files -

Is this the directory its uploading to:

"Stored in: " . "images/imageuploads/" . "

ignace · December 12, 2009

no it isn't

ad_williams · December 12, 2009

where do i define where i want it to save files?

ignace · December 12, 2009

Fixed

<?php

function isValidImage($imagePath) {
    $imageSize = getimagesize($imagePath);
    return preg_match('/image\/(jpg|jpeg|gif|png)/', $imageSize['mime']);
}

function formatBytes($bytes) {
    $abbr = array('KB', 'MB', 'GB', 'TB');
    while ($bytes > 1024 && next($abbr)) {
        $bytes /= 1024;
    }
    return $bytes . ' ' . current($abbr);
}

$f = $_FILES['file'];
if (isValidImage($f['tmp_name'])) {
    if (UPLOAD_ERR_OK !== $f['error']) {
        echo 'Return Code: ' . $f['error'] . '<br />';
    } else {
        echo 'Upload: ' . $f['name'] . '<br />';
        echo 'Type: ' . $f['type'] . '<br />';
        echo 'Size: ' . formatBytes($f['size']) . '<br />';
        echo 'Temp file: ' . $f['tmp_name'] . '<br />';
        
        $filePath = implode(DIRECTORY_SEPARATOR, array('images', 'imageuploads', $f['name']));
        if (file_exists($filePath)) {
            echo $f['name'] . ' already exists. ';
        } else {
            if (move_uploaded_file($f['tmp_name'], $filePath)) {
                echo 'Stored in: ' . $filePath;
            }
        }
    }
}
?>

The most important thing here is that you realize that you could have solved this problem yourself if you would have kept your code readable. Don't forget that you or someone else in the future may be reviewing this code just like you now review my code.

ad_williams · December 12, 2009

Thanks - but how do i add an message in if the file is the wrong type

ignace · December 12, 2009

just add an else on if (move_uploaded_file(..))

ad_williams · December 12, 2009

does that script restrict size?

ignace · December 12, 2009

No. But you can add it easily:

return preg_match('/image\/(jpg|jpeg|gif|png)/', $imageSize['mime']) && filesize($imagePath) > 0;

Fit for your needs.

ad_williams · December 17, 2009

sorry to bring this back up - but where do i add the error message where the file isnt in the right format.

adam

ignace · December 17, 2009

if (isValidImage(..)) {
    ...
} else {
    echo 'wrong image';
}

Sign In

Uploading Files

Recommended Posts

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Link to comment

Share on other sites

Join the conversation

Important Information