php creates folder of same name

[russthebarber]

I have a form for uploading pictures. The form sends a file and a user_id to a .php file which among other things, does the following:

1. creates a folder based on the user_id

2. uploads the file to it

 

If the folder exists already, there is a warning message. This all works fine.

 

<?php

$uploadedfile = $_POST['uploadedfile'];
$userId = $_POST['userId'];

echo $userId."<br />";

if ($_FILES["file"]["error"] > 0){
echo "Error: " . $_FILES["file"]["error"] . "<br />";
}
else{
$thisdir = getcwd();//finds absolute path of this file
//does folder exist
if(file_exists($thisdir."/images"."/userFotos".$userId)) {
	echo "Folder based on userId exists already <br />";
}else{
	//create new folder based on userId
	echo "This directory is: ".$thisdir."<br />";
	/* create subfolder and make world-writable (CHMOD 0777). Tell me if success or failure... */
	if(mkdir($thisdir ."/images"."/userFotos".$userId , 0777)){
		echo "Directory".$thisdir ."/images"."/userFotos".$userId." has been created successfully...<br />";
	}else{
		echo "Failed to create directory...";
	}
}

// etc etc. All works OK

 

There is then a button which sends the user id back to the uploads page if the user wishes to upload more images:

 

<form action="uploadTheFile.php" method="post" accept-charset="utf-8">

<input type="hidden" name="userId" value="<?php echo $userId; ?>
" id="userId">
<input type="submit" value="Back to image uploads">
</form>

 

Then the user can do it all again. The problem is that the second time the user browses an image and sends to the php file for folder creation/image upload I have the following problems:

1. The warning message saying that the folder already exists doesn't show up.

2. php creates a second folder with the same name and uploads the image there.

 

Can anyone tell me why this is happening? Here is the original form...

 

<?php
$userId = $_POST['userId'];
echo $userId."<br />";
?>

<form action="uploadTheFile_submit.php" method="post" enctype="multipart/form-data">
     Choose a file to upload: <input name="uploadedfile" type="file" />
     <input type="hidden" name="userId" value="<?php echo $userId; ?>" id="userId" />	
     <input type="submit" value="Upload File" />
</form>	

 

 

 

 

 

 

[xyph]

How can you have two folders with the same name in a directory?

 

Allowing the user to define $userId is a BAD idea.

[russthebarber]

I've just noticed my folders had spaces in the names so of course they didn't have the same name. I thought that was impossible so it's the first place I looked.  I trimmed my $_POST variables and the problem has been solved now. Thanks. What did you mean allowing the user to dfine userId.... the user doesn't define his or her own id.

[xyph]

If you're going by the hidden value in the form, the user can manipulate it.

[russthebarber]

Thanks for the tip. You've prompted me to start reading up a bit on PHP security and bad coding.