Help on what to search for..

[mistertylersmith]

Hi,

I'm new to the forums and also to php.  I know i'm supposed to try to find the answer on my own but honestly, i'm not quite sure what i'm looking for.  the situation is this: i want to create a form that allows users to upload their photo.  during the process script i want to check to make sure the file is an appropriate type, then resize to a fixed width and height, and save to a directory(or a mysql server)... the theory is that this will reduce resource usage when all is said and done.  based on the searching ive done so far i think it is possible to do using the gd library which i have enabled.  this is the work i have done so far

 form.php
<form enctype="multipart/form-data" action="thumbnail_upload.php" method="POST">
File: 
<input name="uploadedfile" type="file" /><br />
<input type="submit" value="Upload File" />
</form>

 

thumbnail_upload.php
<?php
//get image from form
$uploaded_file = $_FILES['uploadedfile']['tmp_name'];
$is_image = 0;
$image_size = getimagesize($uploaded_file);
$image_width = $image_size[0];
$image_height = $image_size[1];


//check to see that file was uploaded
if (is_uploaded_file($_FILES['uploadedfile']['tmp_name'])) {

} else {
   echo "Upload failed: ".$_FILES['uploadedfile']['error'];
}

//check that file is an .png, .jpg, or .gif
$ext  =  strtoupper(get_file_extension($_FILES['uploadedfile']['name']));
if ($ext == ".GIF" || $ext == ".JPEG" || $ext == ".JPG" || $ext == ".PNG"){
	$is_image = 1;
}
//code to create a thumbnail from the file... 
//THIS DOES NOT WORK
$thumb = imagecreatetruecolor (200, 325);
$im = imagecreatefromgif ($uploaded_file); 
    if (!$im) { 
        echo "Error uploading.";
    }
imagecopyresampled($thumb, $im, 0, 0, 0, 0, 200, 325, $image_width, $image_height);
$imagegif($im);
?>

//function for getting the file extension of a file
function get_file_extension($file) {
  $pos = strrpos($file, '.');
	  if(!$pos) {
		return 'Unknown Filetype';
	  }
  $str = substr($file, $pos, strlen($file));
  	return $str;
}

 

and so despite not being able to even output the file from the form i have no idea of how to save the thumbnails to a director for me to call on later =\ if someone could tell me what I should look for or what I am missing I would greatly appreciate it.

 

[Barand]

To output an an image from a php script you need to send a content-type header before output with imagegif()

 

<?php
header ("content-type: image/gif");
imagegif ($image);

 

To save to a file, specify filename as the second argument to imagegif($image, 'path/to/filename');

 

Make sure you have write permissions to the directory.

[mistertylersmith]

can i only work with one file type per page then? say i wanted to display multiple images, would they all have to be gifs?

[Barand]

A gd script can only output one type but a page can contain several images of any type.

 

You place the images on the page with img tags

<img src='myimage1.php'>
<img src='myimage2.php'>
etc

[mistertylersmith]

i think i have what i need to know now, thank you for your help 

one more question: in some other code ive seen around for similar applications of the gd library i see functions being used with an @ in front.. for example

<?php @imagecreatetruecolor(200, 300); ?>

what does that mean?

[Barand]

see

http://www.php.net/manual/en/language.operators.errorcontrol.php

[wolfrat]

Ok, I'm not too sure about this, but couldn't this be insecure? As you are only checking the file extension, and seem to be uploading the file before resizing it (correct me if I'm wrong). So technically, if a user knew where the images where going to be uploaded, he/she could potentially upload malicious files.

 

This is what I use in my image upload scripts to make sure that the uploaded file is an image:

$imageInfo = getimagesize($_FILES['avatar']['tmp_name']);
if (!in_array($imageInfo[2], array(2, 3)))
    {
// tell the user that they can only upload valid images
}
else
{
//upload the image, resize, whatever
}

something like that anyway, it just checks to see if the script can find the dimensions of the image.

 

And the @ in front of commands tells the php thing not to print out the error details, useful for mysql commands (you don't want everyone seeing your sql table structure in the event of an sql server outage or something)