Image Upload / Url upload

[Goose87]

Ok, before anyone gets angry because I'm typing a question that has 1 million posts on the web about, I am posting because I am merely confused..

 

Every single website I look at uses different methods and has strange functions I am not aware of.

 

I will explain what I need and why I am struggling to do it:

 

Users on my website have a profile.  On that profile I would like an image (in the future maybe a number of images) and I would like to let me users upload images to be shown there.  I need the following:

 

- Image upload (or entering of url for image on somewhere like imageshack.us for example..)

- File verification

- Image resizing

- Saving of file using the user's ID so it can easily be referred to

 

Every single script I have seen either confuses me, or I have no idea how to edit it to get what I want.

 

I am also extremely worried about the security.  That's why I'm thinking letting the users enter a URL to an image uploading website might be a good idea.  That way, I can just link to the url.  I have yet to find a tutorial on this though.

 

Any help is appreciated.  I am not asking for you to do it for me, I merely need a good push in the right direction.

 

Many thanks in advance,

 

Goose.

[Goose87]

Ok... my current code that I'm using from a script is below.

 

I haven't managed to add a resizing feature yet.  I also modified it to only accept PNGs because it caused problems when displaying it ( I had a file that was $userID.jpg and $userID.jpg and it didn't know which one to show )

 

I solved the resize problem by just forcing the image, when being displayed, to be fixed to height 200 and width 150.  This obviously causes resizing problems, but I'm assuming the users can deal with that problem, as I don't really know what I am doing...

 

<?php

include("includes/header.php");

echo "<p class='h1'>Upload an image</p>";

echo "<span class='content_text'>";

//define a maxim size for the uploaded images in Kb
define ("MAX_SIZE","30"); 

//This function reads the extension of the file. It is used to determine if the file  is an image by checking the extension.
function getExtension($str) {
         $i = strrpos($str,".");
         if (!$i) { return ""; }
         $l = strlen($str) - $i;
         $ext = substr($str,$i+1,$l);
         return $ext;
}

//This variable is used as a flag. The value is initialized with 0 (meaning no error  found)  
//and it will be changed to 1 if an errro occures.  
//If the error occures the file will not be uploaded.
$errors=0;
//checks if the form has been submitted
if(isset($_POST['Submit'])) 
{
	//reads the name of the file the user submitted for uploading
	$image=$_FILES['image']['name'];
	//if it is not empty
	if ($image) 
	{
	//get the original name of the file from the clients machine
		$filename = stripslashes($_FILES['image']['name']);
	//get the extension of the file in a lower case format
  		$extension = getExtension($filename);
		$extension = strtolower($extension);
	//if it is not a known extension, we will suppose it is an error and will not  upload the file,  
//otherwise we will do more tests
if (($extension != "png")) 
		{
	//print error message
			echo "<p class='h2'>Your image must be in PNG format.</p>";
			$errors=1;
		}
		else
		{
//get the size of the image in bytes
//$_FILES['image']['tmp_name'] is the temporary filename of the file
//in which the uploaded file was stored on the server
$size=filesize($_FILES['image']['tmp_name']);

//compare the size with the maxim size we defined and print error if bigger
if ($size > MAX_SIZE*1024)
{
echo "<p class='h2'>You have exceeded the size limit!</p>";
$errors=1;
}

//we will give an unique name, for example the time in unix time format
$image_name=$user_id.'.'.$extension;
//the new name will be containing the full path where will be stored (images folder)
$newname="images/profile_avatar/".$image_name;
//we verify if the image has been uploaded, and print error instead
$copied = copy($_FILES['image']['tmp_name'], $newname);
if (!$copied) 
{
echo "<p class='h2'>Copy unsuccessfull!</p>";
$errors=1;
include("includes/footer.php");
}}}}

//If no errors registred, print the success message
if(isset($_POST['Submit']) && !$errors) 
{
@mysql_query("xxxxx");    // HERE I ADDED A QUERY TO SET A VALUE IN THE DB TO 1 TO LET THE PROFILE PAGE KNOW THERE IS AN IMAGE THERE..
	echo "<p class='h1'>File Uploaded Successfully!</p>";
include("includes/footer.php");
}

?>


<div align='center'>
<table width='400'>
<tr class='bg1'>
	<td>
		 <form name="newad" method="post" enctype="multipart/form-data"  action="">
		 <table>
		 	<tr><td><input type="file" name="image"></td></tr>
		 	<tr><td><input name="Submit" type="submit" value="Upload image"></td></tr>
		 </table>	
		 </form>
	</td>
 </tr>
</table>

 

 

How does that look?  Any advice?

[Goose87]

Could anyone look at my code and help me out with this one?  Thanks a lot