uploading files via the web [Archive]

Kagey

Oct 13th, 2002, 03:50 PM

go to www.php.net. near the top there is a search bar. type in "file uploads" in the "online documentation". then, click the arrow symbolizing "search". I'm fairly positive that the result you receive will be helpful to solve this problem.

HAPPY CANADIAN THANKSGIVING !! WOOO HOOOO

Paxthegreat

Oct 13th, 2002, 05:30 PM

hmm, i've found a lil manual, which kinda explains stuff, but, theirs no examples of the pages itself :-/.

<--- needs something to disect and look at

Rick Bull

Oct 14th, 2002, 04:32 AM

This is from a book called PHP for the Word Wide Web by Larry Ullman. It says you do it like this:

HTML:

<form method="post" enctype="multipart/form-data" action="whatever.php">
<input type="file" name="File" />
<input type="submit" value="Upload" />
</form>

PHP:

if ($File) {
print ("File name: $File_name<br />\n");
print ("File size: $File_size<br />\n");
if (copy($File, "users/$File_name")) {
print "Your file was successfully uploaded";
} else {
print "Your file was not successfully uploaded";
}
unlink($File);
}

Paxthegreat

Oct 14th, 2002, 07:06 PM

hmm, riiight, now coz i'm still learning PHP, i dont know everything, so bare with me on this 1

if ($File) {
print ("File name: $File_name<br />\n");
print ("File size: $File_size<br />\n");
if (copy($File, "users/$File_name")) {
print "Your file was successfully uploaded";
} else {
print "Your file was not successfully uploaded";
}
unlink($File);
}

i think i understand this, and i understand what the html code does, but how do incorporate this into my page? (n00bish question i know)

Rick Bull

Oct 15th, 2002, 06:09 AM

You just have to put that code into the "whatever.php" file (the one in the form's action) and it should copy the file to the users directory.

phpman

Oct 15th, 2002, 01:00 PM

it realy all depends on what version of php you are using. if anyhting over 4.1 and register_globols are off then you have to use $_FILES[uploaded_file][tmp_name]

and then it would be something like this

if ($_POST['submit']){
if(!copy($_FILES['uploadedfile']['tmp_name'],"files/".$_FILES['uploadedfile']['name']."")) {
print("<div><b>Sorry, Your File failed to upload.<br>");
print("Please use your back button and try again.</b></div>");

exit;
}else {
// everything looks ok and it was uploaded and saved.
print("<div><b>Thanks, your file has been uploaded.</div><br>");

}

that is very basic and you would want to add some other checks in there to see if the file isn't empty or the wrong extension and stuff like that.

there are a lot of tutorials on the net that explain how to do this.

Paxthegreat

Oct 15th, 2002, 02:59 PM

hmm, i know "very" little about PHP, so

if anyhting over 4.1 and register_globols are off then you have to use $_FILES[uploaded_file][tmp_name]

would explain y this didnt work

-- <html>
-- <?
-- if(!empty($userfile)) {
-- copy($userfile, "/home/duke/webroot/files/");
-- unlink($userfile);
-- echo("file uploaded");
-- }
-- ?>
-- </html>

and came up with this error?!?

-- Warning: Unable to create '/home/duke/webroot/files/': Is a
-- directory in /home/duke/webroot/myupload.php on line 7
-- file uploaded

Paxthegreat

Oct 15th, 2002, 03:01 PM

blah, i just read my last post, and it doesnt even make sense to me.

Erm short version

i tried this code

<html>
<?

if(!empty($userfile)) {

//copy the file
copy($userfile, "/home/duke/webroot/files/");

//destroy the uploaded file
unlink($userfile);

//display message
echo("file uploaded");

}
?>
</html>

and got this error

Warning: Unable to create '/home/duke/webroot/files/': Is a directory in /home/duke/webroot/myupload.php on line 7
file uploaded

i have the latest version of PHP so, is this the problem?

if anyhting over 4.1 and register_globols are off then you have to use $_FILES[uploaded_file][tmp_name]

phpman

Oct 15th, 2002, 04:09 PM

where is $userfile being created? for one it is empty because if globals are off then you have to use the superglobal. check that first.

second you have to include the file name. $userfile is nothing to copy()

you need to use $HTTP_POST_FILES OR $_FILES[]

either one will be like this

[userfile][tmp_name] and [userfile][name]

look at my example and substitute eithe one into it. either $HTTP_POST_FILES OR $_FILES

Rick Bull

Oct 16th, 2002, 05:15 AM

Maybe you need the directory to be chmoded to writeable?

Paxthegreat

Oct 16th, 2002, 05:55 AM

Originally posted by Rick Bull
Maybe you need the directory to be chmoded to writeable?

i've chmodded the dir to 777

Rick Bull

Oct 16th, 2002, 10:35 AM

On my server I sometimes have trouble if I'm using absolute paths like, e.g. try changing copy($userfile, "/home/duke/webroot/files/"); for something like copy($userfile, "files/"); probably won't help though.

Paxthegreat

Oct 16th, 2002, 11:29 AM

Originally posted by Rick Bull
On my server I sometimes have trouble if I'm using absolute paths like, e.g. try changing copy($userfile, "/home/duke/webroot/files/"); for something like copy($userfile, "files/"); probably won't help though.

i thought about that this morning, and changed it so simply files/ same problem

CornedBee

Oct 16th, 2002, 11:30 AM

You need to specify a filename to copy to. You can't just copy to the directory.

The error it gives makes sense if you know what it means. It can't create the file "whatever/somesubdir/" because somesubdir already exists as a directory.

Paxthegreat

Oct 16th, 2002, 11:40 AM

Originally posted by CornedBee
You need to specify a filename to copy to. You can't just copy to the directory.

The error it gives makes sense if you know what it means. It can't create the file "whatever/somesubdir/" because somesubdir already exists as a directory.

hmm, i stuck "file.txt" at the end and it worked, but kept the name file.txt, HOWEVER it was still the file iuploaded it as, ie a .jpg

(if that makes any sense) how do i get it to keep the original file name? as when i stuck $userfile on the end it just crapped out and gave another error

Unable to create 'files//tmp/phpXdHdMU': No such file or directory in /home/duke/webroot/myupload.php on line 7

phpman

Oct 16th, 2002, 11:45 AM

Paxthegreat

Oct 16th, 2002, 11:50 AM

Originally posted by phpman

where is $userfile being created? for one it is empty because if globals are off then you have to use the superglobal. check that first.

second you have to include the file name. $userfile is nothing to copy()

you need to use $HTTP_POST_FILES OR $_FILES[]

either one will be like this

[userfile][tmp_name] and [userfile][name]

look at my example and substitute eithe one into it. either $HTTP_POST_FILES OR $_FILES
ahem.... I already told you once. you have to use the globals, no if ands or buts

sry i thought i was clear at the beggining i am "entirely" a n00b to php coding, so i dont have a single clue what either of those mean, hense the reason i have been looking for a simpler way to do it.

it would help more, if you could give me an example of how to do it, rather than saying use either $http_post_files or $_files as, i dont know how to use this constructively

CornedBee

Oct 16th, 2002, 11:57 AM

Very simple pax: just extract the filename from the uploaded file's path and name (by searching for the last / and only using the substring that comes after that) and stick that at the end of the path. Or sometimes it makes sense to create a random name. Usually by taking the current system time, adding a random factor and calculation an md5 checksum, then using that as the file name (that's the way my brother does it). Pretty much guarantees unique file name (else they would be overwritten). If you want to preserve the original name you must cross-relate the generated and real names in a database table.

phpman

Oct 16th, 2002, 11:58 AM

Originally posted by phpman
it realy all depends on what version of php you are using. if anyhting over 4.1 and register_globols are off then you have to use $_FILES[uploaded_file][tmp_name]

and then it would be something like this

if ($_POST['submit']){
if(!copy($_FILES['uploadedfile']['tmp_name'],"files/".$_FILES['uploadedfile']['name']."")) {
print("<div><b>Sorry, Your File failed to upload.<br>");
print("Please use your back button and try again.</b></div>");

exit;
}else {
// everything looks ok and it was uploaded and saved.
print("<div><b>Thanks, your file has been uploaded.</div><br>");

}

that is very basic and you would want to add some other checks in there to see if the file isn't empty or the wrong extension and stuff like that.

there are a lot of tutorials on the net that explain how to do this.
do you not read, I already gave it to you in my first post.

phpman

Oct 16th, 2002, 12:00 PM

Originally posted by CornedBee
Very simple pax: just extract the filename from the uploaded file's path and name (by searching for the last / and only using the substring that comes after that) and stick that at the end of the path. Or sometimes it makes sense to create a random name. Usually by taking the current system time, adding a random factor and calculation an md5 checksum, then using that as the file name (that's the way my brother does it). Pretty much guarantees unique file name (else they would be overwritten). If you want to preserve the original name you must cross-relate the generated and real names in a database table.
ugg he is a noob and you told him to use md5() and you don't need a Database to get the file name.

my example does it jsut fine and preserves the file name

CornedBee

Oct 16th, 2002, 12:10 PM

Hey, hey. I told him a simple way to get it right. Then I gave him another (advanced) option to remember for the future. What's wrong with that?

Is this better?

Very simple pax: just extract the filename from the uploaded file's path and name (by searching for the last / and only using the substring that comes after that) and stick that at the end of the path.

WARNING!
The part of the post that follows proposes an advanced option that is probably not possible for you to write at your current skill level. Proceed at your own risk.

Or sometimes it makes sense to create a random name. Usually by taking the current system time, adding a random factor and calculation an md5 checksum, then using that as the file name (that's the way my brother does it). Pretty much guarantees unique file name (else they would be overwritten). If you want to preserve the original name you must cross-relate the generated and real names in a database table.

And phpman, you need a database to do THAT. Or at least a text file, but a text file is slower to search.

phpman

Oct 16th, 2002, 12:17 PM

no there is nothing wrong with giving him another option, but why if he can't understand the easy way.

for one you don't need to do any substr() or any other function to do what he wants, to upload a simple file.

everything you need is in $_FILES['uploadedfile']['name'] the superglobal.

even if you do use the md5() you can cross reference it with the superglobal you used to get the file uploaded in the first place. still no DB needed. you don't need a DB for anything that constitutes a file upload, (onle if you save the file name to the DB)

but you can gerenate a unique name and then get the orginal name back without the use of a DB, as long as you don't save it anywhere first and the $_FILES[] global is not empty.

CornedBee

Oct 16th, 2002, 12:47 PM

Didn't know about the 'name' entry. You're right there.

But how do I get the real name back in a later session if the file was saved under a random name without a DB or something comparable?

The problem this is trying to solve is this: You have a system where everyone can upload image files to insert somewhere. Now there is danger that some user accidently overwrites his own or even somebody else's files by uploading a file with the same name. To avoid this you can give random names to the files. But in order to display the user a good name you must store the old name. If you have any idea how to do this without a database I'm sure my brother would appreciate it.

phpman

Oct 16th, 2002, 01:31 PM

well you hit the point right there. unless you store the name somewhere for future reference then you can't. that is where a DB comes in handy.

unless you make the random name come before the orignal name or vise-versa than you wouldn't need a DB.

so the file name would be kind of long but it would contain the orginal name if you neded to change it back for some reason.

Paxthegreat

Oct 17th, 2002, 10:48 AM

Originally posted by phpman
no there is nothing wrong with giving him another option, but why if he can't understand the easy way.

for one you don't need to do any substr() or any other function to do what he wants, to upload a simple file.

everything you need is in $_FILES['uploadedfile']['name'] the superglobal.

even if you do use the md5() you can cross reference it with the superglobal you used to get the file uploaded in the first place. still no DB needed. you don't need a DB for anything that constitutes a file upload, (onle if you save the file name to the DB)

but you can gerenate a unique name and then get the orginal name back without the use of a DB, as long as you don't save it anywhere first and the $_FILES[] global is not empty.

ok, my internet was down for most of the night yesterday, so i had a lot of time to read, and flicked thru the upload section of the php manual, and it does say pretty much what ur saying, the example it gave though doesnt work, any ideas?

phpman

Oct 17th, 2002, 11:22 AM

lets see the code you used for it.

Paxthegreat

Oct 17th, 2002, 11:26 AM

HTML file

<html>
<title>Upload Demo</title>
<form enctype="multipart/form-data" action="upload.php" method="post">
<input type="hidden" name="MAX_FILE_SIZE" value="10000">
File To Be Uploaded: <input name="userfile" type="file">
<BR><input type="submit" value="Upload">
</form>
</html>

PHP file

<html>
<?php
if (is_uploaded_file($_FILES['userfile']['tmp_name'])) {
copy($_FILES['userfile']['tmp_name'], "/home/duke/webroot/files");
} else {
echo "Possible file upload attack. Filename: " . $_FILES['userfile']['name'];
}
?>

</html>

phpman

Oct 17th, 2002, 01:52 PM

you forgot the file

<html>
<?php
if (is_uploaded_file($_FILES['userfile']['tmp_name'])) {
copy($_FILES['userfile']['tmp_name'], "/home/duke/webroot/files/" . $_FILES['userfile']['name']."");
} else {
echo "Possible file upload attack. Filename: " . $_FILES['userfile']['name'];
}
?>

</html>

Paxthegreat

Oct 17th, 2002, 02:02 PM

hmm, well its a change, now im getting a different error atleast, its displaying the

Possible file upload attack. Filename:

msg, any ideas?

phpman

Oct 17th, 2002, 03:08 PM

ok try this

<html>
<?php
$folder = "/home/duke/webroot/files";
if (is_uploaded_file($_FILES['userfile']['tmp_name'])) {
copy($_FILES['userfile']['tmp_name'], "$folder/" . $_FILES['userfile']['name']."");
} else {
echo "Possible file upload attack. Filename: " . $_FILES['userfile']['name'];
}
?>

Paxthegreat

Oct 17th, 2002, 03:40 PM

nope still brings up the same error

http://duke.pax3k.co.uk/upload.htm

phpman

Oct 17th, 2002, 05:07 PM

I didn't get an error, I uploaded something, a image. it didn't say anything so look and see if it is in the directory.

Paxthegreat

Oct 17th, 2002, 06:13 PM

hmm, weird i cant upload anything, but you have and so has a friend, but i asked another person and he got the same msg as me

I Try It: using IE v6 WinXP (doesnt work)
Friend 1: IE v6 winXP (works)
Friend 2: IE v6 Win2k (doesnt work)
You Try it: dunno what (works)

hmm :-/

Sastraxi

Oct 17th, 2002, 06:35 PM

I got:Possible file upload attack. Filename: editor.jpg:confused:

Paxthegreat

Oct 17th, 2002, 06:49 PM

Originally posted by Sastraxi
I got::confused:

yeah, its weird some ppl can upload (displays a blank screen) others cant upload and get a msg as above

any suggestions

phpman

Oct 18th, 2002, 09:33 AM

I am on a win2K and IE6

try it this way

<html>
<?php
if (trim($_FILES['userfile']['tmp_name'])!="none" and trim($_FILES['userfile']['tmp_name'])!="" and trim($_FILES['userfile']['name'])!="") {
if(!copy($_FILES['userfile']['tmp_name'], "/home/duke/webroot/files/" . $_FILES['userfile']['name'].""){
} else {
echo "failed to copy!";
exit;
}
} else {
echo "Possible file upload attack. Filename: " . $_FILES['userfile']['name'];
}
?>

</html>

now if you get the error "possible file upload attack" it is because the file was empty and it didn't upload.

Paxthegreat

Oct 18th, 2002, 10:23 AM

Parse error: parse error, unexpected '{' in /home/duke/webroot/upload.php on line 5

:-/

phpman

Oct 18th, 2002, 10:31 AM

hehe oops sorry

<html>
<?php
if (trim($_FILES['userfile']['tmp_name'])!="none" and trim($_FILES['userfile']['tmp_name'])!="" and trim($_FILES['userfile']['name'])!="") {
if(!copy($_FILES['userfile']['tmp_name'], "/home/duke/webroot/files/" . $_FILES['userfile']['name'].""){
echo "failed to copy!";
exit;
}

} else {
echo "Possible file upload attack. Filename: " . $_FILES['userfile']['name'];
}
?>

</html>

Paxthegreat

Oct 18th, 2002, 10:37 AM

Parse error: parse error, unexpected '{' in /home/duke/webroot/upload.php on line 5

phpman

Oct 18th, 2002, 10:44 AM

one of these times I will get it right :)

<html>
<?php
if (trim($_FILES['userfile']['tmp_name'])!="none" and trim($_FILES['userfile']['tmp_name'])!="" and trim($_FILES['userfile']['name'])!="") {
if(!copy($_FILES['userfile']['tmp_name'], "/home/duke/webroot/files/" . $_FILES['userfile']['name']."")){
echo "failed to copy!";
exit;
}

} else {
echo "Possible file upload attack. Filename: " . $_FILES['userfile']['name'];
}
?>

</html>

Paxthegreat

Oct 18th, 2002, 10:46 AM

Possible file upload attack. Filename: wood096.jpg

Paxthegreat

Oct 18th, 2002, 10:48 AM

ok, i just got a random american to test it, and it works for him

phpman

Oct 18th, 2002, 10:50 AM

then your file is not getting to the server. it was "none" or empty.

do you have a firewall or something that is stopping it. becasue it should work if you upload a file. what is the whole script?

also if it works for some people than it has to work for you.

Paxthegreat

Oct 18th, 2002, 10:51 AM

i dont have a firewall or proxy, when u say whole script? that is the whole script and it isnt just me who it doesnt work for.

and the file isnt empty as its a .jpg, and ... is simply a .jpg

phpman

Oct 18th, 2002, 10:53 AM

I know you put a file in there but the file isn't getting to the server in the temp upload directory. it gets lost in the transmission.

what is the form you use to upload the file?

Paxthegreat

Oct 18th, 2002, 10:55 AM

<html>
<title>Upload Demo</title>
<form enctype="multipart/form-data" action="upload.php" method="post">
<input type="hidden" name="MAX_FILE_SIZE" value="10000">
File To Be Uploaded: <input name="userfile" type="file">
<BR><input type="submit" value="Upload">
</form>
</html>

Paxthegreat

Oct 18th, 2002, 11:00 AM

erm, i think i know what the problem was

name="MAX_FILE_SIZE" value="10000"

ie 10k?

i just changed it to 100k and i just uploaded an image

phpman

Oct 18th, 2002, 11:00 AM

what is the size of the image you are upoading? I know it shouldn't amtter but you only set the max_size to 10K, change it to 100K

other than that is should work for everybody not just random people.

Paxthegreat

Oct 18th, 2002, 11:01 AM

:rolleyes: :rolleyes: :( :( :rolleyes: :rolleyes:

my bad

phpman

Oct 18th, 2002, 11:03 AM

oh thats fine, at least you know now for next time :D

cool it works :D

Paxthegreat

Oct 18th, 2002, 11:04 AM

yep, ty ty ty

now i remember the <HTML> bit, erm, what was the rest again? :D

thx again

Paxthegreat

Oct 18th, 2002, 11:17 AM

lol, ok, just as io thought i got away with this problem, it suddenly craps out, i can upload files now, BUT it wont let me upload some files, varied 1s, like i upload a .txt file then i upload a .jpg then i try and upload a different .txt file it says possible file attack

any ideas?

phpman

Oct 18th, 2002, 11:32 AM

well you haven't done any file extension checking so it shouldn't matter. you shold be able to upload everything and anything.

just make sure anything that is over 100K will not upload. add this

<html>
<?php
$filesize=filesize($_FILES['userfile']['name']);
if ($filesize > $_REQUEST['MAX_FILE_SIZE']){
echo" you exceded teh max file size to be uploaded";
exit;
}
if (trim($_FILES['userfile']['tmp_name'])!="none" and trim($_FILES['userfile']['tmp_name'])!="" and trim($_FILES['userfile']['name'])!="") {
if(!copy($_FILES['userfile']['tmp_name'], "/home/duke/webroot/files/" . $_FILES['userfile']['name']."")){
echo "failed to copy!";
exit;
}

} else {
echo "Possible file upload attack. Filename: " . $_FILES['userfile']['name'];
}
?>

</html>