PHP File Upload

[Altec]

I'm currently writing a gallery with PHP and MySQL and I'm having a little trouble with uploading the photo. Here is what I have right now:

<?php
switch ($_GET['page']) {
case 'process':
	$_FILES["uploaded_file"] = $_POST["uploadedfile"];
	if((!empty($_FILES["uploaded_file"])) && ($_FILES['uploaded_file']['error'] == 0)) {
		$filename = basename($_FILES['uploaded_file']['name']);
		$ext = substr($filename, strrpos($filename, '.') + 1);
		if (($ext == "jpg") && ($_FILES["uploaded_file"]["type"] == "image/jpeg") && ($_FILES["uploaded_file"]["size"] < 2097152)) {
			$newname = '/home/phreakyo/public_html/playground/gallery/photos/'.$filename;
			if (!file_exists($newname)) {
				if ((move_uploaded_file($_FILES['uploaded_file']['tmp_name'],$newname))) {
					echo 'The photo has been saved as: '.$newname;
					$_SESSION['photo_filename'] = $filename;
				} else {
					echo 'Error: A problem occurred during file upload.';
				}
			} else {
				echo 'Error: File '.$_FILES["uploaded_file"]["name"].' already exists.';
			}
		} else {
			echo 'Error: Only .JPG images under 2 megabytes are accepted for upload.';
		}
	} else {
		echo 'Error: No file uploaded.';
	}
break;
default:
?>
<p>Use this form the upload a photo. All uploaded photos are saved to "/photos/."</p>
<form enctype="multipart/form-data" action="add_new_photo.php?page=process" method="POST">
<input type="hidden" name="MAX_FILE_SIZE" value="2097152" />
Choose a photo to upload: <input name="uploadedfile" type="file" /><br />
<input type="submit" value="Upload Photo" />
</form>	
<?php
break;
}
?>

Every time I upload a photo I get "Error: No file uploaded" which means that the file doesn't get uploaded. This is my first attempt at uploading files with PHP, so I'm sure the answer is pretty obvious. Anyone?

[phpSensei]

change

 

$_FILES["uploaded_file"] = $_POST["uploadedfile"];

 

to

 

$_FILES["uploaded_file"] = $_FILES["uploadedfile"];

 

 

[twostars]

Also, I advise you not to make the max file size a hidden input element.

 

Otherwise, you'll get people saving the page and modifying it to upload larger files.

 

Just make it a variable in the PHP script itself.

[toplay]

You should not be assigning anything to $_FILES but rather use it to determine things.

 

The manual has pretty good info on uploading with examples:

http://us.php.net/features.file-upload

 

Our tutorials:

http://www.phpfreaks.com/tutorials/36/0.php

 

http://www.phpfreaks.com/tutorials/85/0.php

[Altec]

The only reason I have the MAX_FILE_UPLOAD size as a hidden form field is because most browsers will catch it. It is by no means an attempt at setting a limit; PHP has an upload limit which is two megabytes. If you didn't notice, the limit (2097152 bytes) is coded into the script itself.

 

@toplay: Basically I just have to change all instances of $_FILES["uploaded_file"] to $_FILES["uploadedfile"], yes?

[phpSensei]

You might want to rename the file if it exists, instead of throwing an error, also, the FILENAME should just be a variable from the beginning, and not a $_POST var. Using In_Array for filetype is more efficient and more flexible, with easy adding and removing file types.

 

Search those functions up.

[Altec]

Thanks for all the help. Here is what I have so far:

<?php
switch ($_GET['page']) {
case 'process':
	if((!empty($_FILES['uploadedfile'])) && ($_FILES['uploadedfile']['error'] == 0)) {
		$filename = basename($_FILES['uploadedfile']['name']);
		$path = pathinfo($_SERVER['SCRIPT_FILENAME']); $serv_path = str_replace('admin', 'photos', $path['dirname']);
		$ext = substr($filename, strrpos($filename, '.') + 1);
		if (($ext == 'jpg') && ($_FILES['uploadedfile']['type'] == 'image/jpeg') && ($_FILES['uploadedfile']['size'] < 2097152)) {
			$newname = $serv_path.'/'.$filename;
			if (!file_exists($newname)) {
				if ((move_uploaded_file($_FILES['uploadedfile']['tmp_name'],$newname))) {
					echo 'The photo has been saved as: '.$newname;
					$_SESSION['photo_filename'] = $filename;
				} else {
					echo 'Error: A problem occurred during file upload.';
				}
			} else {
				echo 'Error: File '.$_FILES["uploadedfile"]["name"].' already exists.';
			}
		} else {
			echo 'Error: Only .JPG images under 2 megabytes are accepted for upload.';
		}
	} else {
		echo 'Error: No file uploaded.';
	}
break;
default:
?>
<p>Use this form to upload a photo.</p>
<form enctype="multipart/form-data" action="add_new_photo.php?page=process" method="POST">
<input type="hidden" name="MAX_FILE_SIZE" value="2097152" />
Choose a photo to upload: <input name="uploadedfile" type="file" /><br />
<input type="submit" value="Upload Photo" />
</form>	
<?php
break;
}
?>

It works like a charm. However, I'd like to follow up on phpSensei's idea, but with a small twist. I want the file to be uploaded but with a different filename. Here is what I tried:

<?php
switch ($_GET['page']) {
case 'process':
	function rand_string($len, $chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789') {
		$string = '';
		for ($i = 0; $i < $len; $i++) {
			$pos = rand(0, strlen($chars)-1);
			$string .= $chars{$pos};
		}
	return $string; }
	if((!empty($_FILES['uploadedfile'])) && ($_FILES['uploadedfile']['error'] == 0)) {
		$filename = rand_string(10).'.jpg';
		$path = pathinfo($_SERVER['SCRIPT_FILENAME']); $serv_path = str_replace('admin', 'photos', $path['dirname']);
		$ext = substr($filename, strrpos($filename, '.') + 1);
		if (($ext == 'jpg') && ($_FILES['uploadedfile']['type'] == 'image/jpeg') && ($_FILES['uploadedfile']['size'] < 2097152)) {
			$newname = $serv_path.'/'.$filename;
			if (!file_exists($newname)) {
				if ((move_uploaded_file($_FILES['uploadedfile']['tmp_name'],$newname))) {
					echo 'The photo has been saved as: '.$newname;
					$_SESSION['photo_filename'] = $filename;
				} else {
					echo 'Error: A problem occurred during file upload.';
				}
			} else {
				echo 'Error: File '.$_FILES["uploadedfile"]["name"].' already exists.';
			}
		} else {
			echo 'Error: Only .JPG images under 2 megabytes are accepted for upload.';
		}
	} else {
		echo 'Error: No file uploaded.';
	}
break;
default:
?>
<p>Use this form to upload a photo.</p>
<form enctype="multipart/form-data" action="add_new_photo.php?page=process" method="POST">
<input type="hidden" name="MAX_FILE_SIZE" value="2097152" />
Choose a photo to upload: <input name="uploadedfile" type="file" /><br />
<input type="submit" value="Upload Photo" />
</form>	
<?php
break;
}
?>

However, the name doesn't change when the same image is uploaded. Also, there is a fundamental flaw in naming the file right there, if you know what I mean.