Uploading files

[steve-t]

I have a website where I wish users to be able to upload PDF and Powerpoint ppt files only.

I have used the following code which works fine with PDFs but with powerpoint files the page goes blank and says done and no file is uploaded.

[code]if(!ereg("application/pdf",$_FILES['user_file']['type']))   
{
if (!ereg("application/vnd.ms-powerpoint",$_FILES['user_file']['type']))
{
$message="File is not a PDF or Powerpoint file. Please try another file.<br>";
include("file_manager.inc");
exit();
}
}[/code]

Any thoughts how to get this working?

[pthurmond]

I am not sure about this ereg function, but I was setting up a file upload for my site earlier today. Here is the code for it.

Processing script:
[code]
if(isset($_POST['create']))
{
$error = false;

if(isset($_POST['name']))
{
$name = $_POST['name'];
}
else
{
$name = false;
$error = true;
$errormsg .= '<p>You did not enter a name for your activity.</p>';
}

if(isset($_POST['desc']))
{
$desc = $_POST['desc'];
}
else
{
$desc = '';
}

if($name)
{
$query = "INSERT INTO Activities (Name, Description) VALUES ('$name', '$desc')";
$result = mysql_query($query) or die('Query failed: ' . mysql_error());

if($result)
{
if(isset($_FILES['upload']['name']))
{
$extension = explode ('.', $_FILES['upload']['name']);
$aid = mysql_insert_id(); // Upload ID
$filename = 'pictures/' . $aid . '.' . $extension[1];

// Move the file over.
if (move_uploaded_file($_FILES['upload']['tmp_name'], "../pictures/$filename"))
{
$message = '<p>The file has been uploaded!</p>';

$query = "UPDATE Activities SET Picture = '$filename' WHERE Activity_ID = '$aid' ";
$result = mysql_query($query) or die('Query failed: ' . mysql_error());
}
else
{
$error = true;
$errormsg .= '<p><font color="red">The file could not be uploaded.</font></p>';

// Remove the record from the database.
$query = "DELETE FROM Activities WHERE Activity_ID = $aid";
$result = @mysql_query ($query);
}
}
else //If no image was uploaded then set it to the default image.
{
$aid = mysql_insert_id(); // Upload ID
$filename = 'pictures/default.jpg';

$query = "UPDATE Activities SET Picture = '$filename' WHERE Activity_ID = '$aid' ";
$result = mysql_query($query) or die('Query failed: ' . mysql_error());
}
}
}
else
{
$error = true;
}
}

[/code]


Here is the form:
[code]
<form>
<table width="400" border="0" id="table_event">       
<tr>
<th colspan="2" align="center"><font color="#FF0000">Create New Activity</font></th>
</tr>
<tr>
<th colspan="2" align="center">&nbsp;</th>
</tr>
<tr>
<th>Activity Name</th>
<td><input name="name" type="text" width="30"></td>
</tr>
<tr>
<th>Description</th>
<td><input name="desc" type="text" width="30"></td>
</tr>
<tr>
<td><font style="font-weight:bold">Image</font> (optional)</td>
<td><input type="file" name="image" /></td>
<!--<td><input name="image" type="text" width="30">&nbsp;<input type="submit" value=" Browse... " /></td>-->
</tr>
<tr>
<td>&nbsp;</td>
<td>&nbsp;</td>
</tr>
<tr>
<th valign="top">New Image</th>
<td><input type="file" name="newimage" /></td>
</tr>
<tr>
<td>&nbsp;</td>
<td>&nbsp;</td>
</tr>
<tr>
<td><input type="submit" value=" Cancel " /></td>
</tr>
<tr>
<td><input type="reset" value=" Clear Data " /></td>
<td><input name="create" type="submit" value=" Create Activity " /></td>
</tr>
</table>
</form>
[/code]

PHP puts the file into the $_FILE superglobal array. You can limit the extensions uploaded with the explode command: $extension = explode ('.', $_FILES['upload']['name']);
Just do a check on the second row of the $extension array that is created. If it isn't the file type you are looking for then just don't allow the upload.

-Patrick

[noldguy]

You can't rely on mime type. Try checking the extension instead:

[code]if (is_uploaded_file($_FILES['userfile']['tmp_name'])) {
  $array = explode(".", $_FILES[$userfile]['name']);
  $ext = $array[count($array)-1];
  if (!preg_match('/(pdf|ppt)/i', $ext)) {
      $message="File is not a PDF or Powerpoint file. Please try another file.<br>";
      include("file_manager.inc");
      exit();
  }

} else {
  // file was not uploaded error handling code
}[/code]

[steve-t]

Thanks for the comments...getting there slowly. Just tried the following code:

[code]if (is_uploaded_file($_FILES['user_file']['tmp_name']))
{
  $array = explode(".", $_FILES[$userfile]['name']);
  $ext = $array[count($array)-1];
  if (!preg_match('/(pdf|ppt)/i', $ext))
{
  $message="File is not a PDF or Powerpoint file. Please try another file.<br>";
    include("file_manager.inc");
      exit();
  }
}[/code]

When I upload a powerpoint or PDF file now it says "File is not a PDF or Powerpoint file."

Any ideas what I did wrong?

[steve-t]

Could do with getting this sorted today, any help would be much appreciated!!  :)