Uploading Files

[ad_williams]

Well im trying to make a code that will upload images onto my web hosting - ive seen some simple ones on the internet but i need mine to be only accept images..

Here is what ive come up with so far, but it doesnt seem to work. Could someone be so kind and tell me where ive gone wrong + where i can find all the image file types like "image/jpeg" etc.

 

Thanks

 

<?php

if (((($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/pjpeg")
|| ($_FILES["file"]["type"] == "image/png"))
//&& ($_FILES["file"]["size"] < 900000000)
&& ($ext == "jpg" || "png" || "gif"))
  
if ($_FILES["file"]["error"] > 0)
    {
    echo "Return Code: " . $_FILES["file"]["error"] . "<br />";
    }
  else
    {
    echo "Upload: " . $_FILES["file"]["name"] . "<br />";
    echo "Type: " . $_FILES["file"]["type"] . "<br />";
    echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
    echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />";

    if (file_exists("upload/" . $_FILES["file"]["name"]))
      {
      echo $_FILES["file"]["name"] . " already exists. ";
      }
    else
      {
      move_uploaded_file($_FILES["file"]["tmp_name"],
      "upload/" . $_FILES["file"]["name"]);
echo "Stored in: " . "images/imageuploads/" . $_FILES["file"]["name"];
      }
    }
  }
else
  {
  echo "Invalid file";
  }
?> 

[Kieran Menor]

You can't trust $_FILES["file"]["type"] to actually tell the correct filetype as this is provided by the client's browser. Instead look up the getimagesize() function. It also provides info on the file type.

[ad_williams]

ok thanks will do - when i try that code out it says there is an error in the 2nd IF statement, could someone check that out please.

[ignace]

Try:

 

$imageSize = getimagesize($tmp_name); // $tmp_name = $_FILES['attribute-name']['tmp_name']
if (preg_match('/image\/(jpg|jpeg|gif|png)/', $imageSize['mime'])) {
  // your cool stuff here
}

[mrMarcus]

here is a fairly large list with many different mime types.

 

link: Array of MIME Types

 

right off the bat i can see that you're missing a closing ) and you have one too many }:

 

<?php

if (((($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/pjpeg")
|| ($_FILES["file"]["type"] == "image/png"))
//&& ($_FILES["file"]["size"] < 900000000)
&& ($ext == "jpg" || "png" || "gif")) //<---need one more ) here
  
if ($_FILES["file"]["error"] > 0)
    {
    echo "Return Code: " . $_FILES["file"]["error"] . "<br />";
    }
  else
    {
    echo "Upload: " . $_FILES["file"]["name"] . "<br />";
    echo "Type: " . $_FILES["file"]["type"] . "<br />";
    echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
    echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />";

    if (file_exists("upload/" . $_FILES["file"]["name"]))
      {
      echo $_FILES["file"]["name"] . " already exists. ";
      }
    else
      {
      move_uploaded_file($_FILES["file"]["tmp_name"],
      "upload/" . $_FILES["file"]["name"]);
echo "Stored in: " . "images/imageuploads/" . $_FILES["file"]["name"];
      }
    }
  } //<---one too many } .. remove this one
else
  {
  echo "Invalid file";
  }
?>

 

you need to either turn error_reporting on in your php.ini file (if you have access to it), as well as "display_errors", or add this to the top of your script(s), immediately following the first <?php:

 

<?php
ini_set ('display_errors', 1);
error_reporting (E_ALL);

 

this will help you to find any errors that might be happening.

 

and in the future, you need to give more information about what the problems are.  "but it doesnt seem to work." will not suffice.  i can't work with that.  next time you bring your car into the shop, tell the mechanic, "it doesnt seem to work.", and see what he says.

 

and, instead of checking the $_FILES['type'], use getimagesize:

 

<?php
//allowed image mime types;
$allowed_filetypes = array ('image/jpeg', 'image/gif', 'image/png'); //and so on...

$image = getimagesize ($_FILES['file']['tmp_name']);
if (in_array ($image['mime'], $allowed_filetypes))
{
     //correct mime type .. file is ok.  continue doing stuff (more error handling, etc.);
}
else
{
     //incorrect mime type .. something is fishy;
}
?>

 

this is a much better check than just checking the file extension.

 

EDIT: ignace posted a cleaner check:

 

if (preg_match('/image\/(jpg|jpeg|gif|png)/', $image['mime']))

[ad_williams]

so

$imageSize = getimagesize($tmp_name); // $tmp_name = $_FILES['attribute-name']['tmp_name']
if (preg_match('/image\/(jpg|jpeg|gif|png)/', $imageSize['mime'])) {  // your cool stuff here
}

 

what does that replace - sorry but im abit of a php newbie

 

 

@mrMarcus thanks for the Array of MIME types.

[ignace]

About this:

((($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/pjpeg")
|| ($_FILES["file"]["type"] == "image/png"))
//&& ($_FILES["file"]["size"] < 900000000)
&& ($ext == "jpg" || "png" || "gif")

[ad_williams]

right ive added on that image thing.

<?php
ini_set ('display_errors', 1);
error_reporting (E_ALL);

$imageSize = getimagesize($tmp_name); // $tmp_name = $_FILES['attribute-name']['tmp_name']
if (preg_match('/image\/(jpg|jpeg|gif|png)/', $imageSize['mime'])) {  // your cool stuff here
(((($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/pjpeg")
|| ($_FILES["file"]["type"] == "image/png"))
//&& ($_FILES["file"]["size"] < 99999999)))
&& ($ext == "jpg" || "png" || "gif")))
}
if ($_FILES["file"]["error"] > 0)
    {
    echo "Return Code: " . $_FILES["file"]["error"] . "<br />";
    }
  else
    {
    echo "Upload: " . $_FILES["file"]["name"] . "<br />";
    echo "Type: " . $_FILES["file"]["type"] . "<br />";
    echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
    echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />";

    if (file_exists("upload/" . $_FILES["file"]["name"]))
      {
      echo $_FILES["file"]["name"] . " already exists. ";
      }
    else
      {
      move_uploaded_file($_FILES["file"]["tmp_name"],
      "image/imageuploads/" . $_FILES["file"]["name"]);
	echo "Stored in: " . "images/imageuploads/" . $_FILES["file"]["name"];
      }
    }
else
  {
  echo "Invalid file";
  }
?>

and it comes up with this error

Parse error: syntax error, unexpected T_IF in /***/******/************/uploading.php on line 13

 

 

[ignace]

Drop the whole ((()()()()((()(((()))) thing it makes your code unreadable anyway

 

$f = $_FILES['file'];
$imageSize = getimagesize($f['tmp_name']);
if (preg_match('/image\/(jpg|jpeg|gif|png)/', $imageSize['mime'])) {
    if (UPLOAD_ERR_OK !== $f['error']) {
        echo "Return Code: "

 

Additionally you could do:

function isValidImage($imagePath) {
    $imageSize = getimagesize($imagePath);
    return preg_match('/image\/(jpg|jpeg|gif|png)/', $imageSize['mime']);
}

 

Then you can use:

$f = $_FILES['file'];
if (isValidImage($f['tmp_name'])) {

[ad_williams]

does that replace the whole code or just a section??

[ignace]

<?php

function isValidImage($imagePath) {
    $imageSize = getimagesize($imagePath);
    return preg_match('/image\/(jpg|jpeg|gif|png)/', $imageSize['mime']);
}

function formatBytes($bytes) {
    $abbr = array('KB', 'MB', 'GB', 'TB');
    while ($bytes > 1024 && next($abbr)) {
        $bytes /= 1024;
    }
    return $bytes . ' ' . current($abbr);
}

$f = $_FILES['file'];
if (isValidImage($f['tmp_name'])) {
    if (UPLOAD_ERR_OK !== $f['error']) {
        echo 'Return Code: ' . $f['error'] . '<br />';
    } else {
        echo 'Upload: ' . $f['name'] . '<br />';
        echo 'Type: ' . $f['type'] . '<br />';
        echo 'Size: ' . formatBytes($f['size']) . '<br />';
        echo 'Temp file: ' . $f['tmp_name'] . '<br />';
        
        $filePath = implode(DIRECTORY_SEPARATOR, array('upload', $f['name']));
        if (file_exists($filePath)) {
            echo $f['name'] . " already exists. ";
        } else {
            if (move_uploaded_file($f['tmp_name'], $filePath)) {
                echo "Stored in: " . "images/imageuploads/" . $_FILES["file"]["name"];
            }
        }
    }
}
?>

[ad_williams]

it all works but it comes up with these two errors:

 

Warning: move_uploaded_file(upload/2nd Idea + border.png) [function.move-uploaded-file]: failed to open stream: No such file or directory in /****/********/public_html/uploading.php on line 28

 

Warning: move_uploaded_file() [function.move-uploaded-file]: Unable to move '/tmp/phprGOJ5i' to 'upload/2nd Idea + border.png' in /****/********/public_html/uploading.php on line 28

 

Hows do i fix them

 

 

 

 

[ignace]

Are you sure the directories exists and you have permission to create files?

[ad_williams]

yeah i can create files -

Is this the directory its uploading to:

 

"Stored in: " . "images/imageuploads/" . "

[ignace]

no it isn't

[ad_williams]

where do i define where i want it to save files?

[ignace]

Fixed

 

<?php

function isValidImage($imagePath) {
    $imageSize = getimagesize($imagePath);
    return preg_match('/image\/(jpg|jpeg|gif|png)/', $imageSize['mime']);
}

function formatBytes($bytes) {
    $abbr = array('KB', 'MB', 'GB', 'TB');
    while ($bytes > 1024 && next($abbr)) {
        $bytes /= 1024;
    }
    return $bytes . ' ' . current($abbr);
}

$f = $_FILES['file'];
if (isValidImage($f['tmp_name'])) {
    if (UPLOAD_ERR_OK !== $f['error']) {
        echo 'Return Code: ' . $f['error'] . '<br />';
    } else {
        echo 'Upload: ' . $f['name'] . '<br />';
        echo 'Type: ' . $f['type'] . '<br />';
        echo 'Size: ' . formatBytes($f['size']) . '<br />';
        echo 'Temp file: ' . $f['tmp_name'] . '<br />';
        
        $filePath = implode(DIRECTORY_SEPARATOR, array('images', 'imageuploads', $f['name']));
        if (file_exists($filePath)) {
            echo $f['name'] . ' already exists. ';
        } else {
            if (move_uploaded_file($f['tmp_name'], $filePath)) {
                echo 'Stored in: ' . $filePath;
            }
        }
    }
}
?>

 

The most important thing here is that you realize that you could have solved this problem yourself if you would have kept your code readable. Don't forget that you or someone else in the future may be reviewing this code just like you now review my code.

[ad_williams]

Thanks - but how do i add an message in if the file is the wrong type

[ignace]

just add an else on if (move_uploaded_file(..))

[ad_williams]

does that script restrict size?

 

[ignace]

No. But you can add it easily:

 

return preg_match('/image\/(jpg|jpeg|gif|png)/', $imageSize['mime']) && filesize($imagePath) > 0;

 

Fit for your needs.

[ad_williams]

sorry to bring this back up - but where do i add the error message where the file isnt in the right format.

 

adam

[ignace]

if (isValidImage(..)) {
    ...
} else {
    echo 'wrong image';
}