Upload Script help

[red_bull_NRG]

I'm very new to php and I'm working on an upload script. I want it to assign the uploaded file a random name and then save it in a specific directory on the server. For some reason when this code is executed it says that the file already exists. What is causing this?

Here's the code:

<?php

$name = rand(100, 10000000000000);

if (($_FILES["file"]["size"] < 2000000000))
  {
  if ($_FILES["file"]["error"] > 0)
    {
	echo "Error:  " . $_FILES["file"]["error"] . "<br/>";
	}
  else
    {
	echo "Upload:  " . $_FILES["file"]['$name'] . "<br/>";
	echo "Type:  " . $_FILES["file"]["type"] . "<br/>";
	echo "Size:  " . ($_FILES["file"]["size"] / 1024) . " KB<br/>";
	echo "Stored in:  " . $_FILES["file"]['$name'];
	}
  if (file_exists("upload/" . $_FILES["file"]['$name']))
      {
      echo $_FILES["file"]['$name'] . " already exists. ";
      }
      else
      {
      move_uploaded_file($_FILES["file"]["tmp_name"],
      "upload/" . $_FILES["file"]['$name']);
      echo "Stored in: " . "upload/" . $_FILES["file"]['$name'];
      }
    }	
else
  {
  echo "Invalid file";
  }
?>

[kows]

well, you're using $_FILES["file"]['$name'] to reference your variable, but PHP will not recognize any variables within a single quoted string. you would need to use $_FILES['file'][$name] for it to do what you wanted. because the variable you're referencing ($_FILES["file"]['$name']) doesn't exist, file_exists() is checking if the directory "upload/" exists. it's telling you that it indeed does.

HOWEVER, that is only the beginning of the problem. the variable $_FILES["file"]['name'] is a reference to the file's original name, and the way you're doing things would be just saving the file "file.jpg" to "upload/file.jpg," because you're creating this $name variable at the top of the script but you never actually use it. so, instead of using $_FILES["file"]['name'], just use $name.

      if (file_exists("upload/" . $name))
      {
          echo $name . " already exists. ";
      }
      else
      {
          move_uploaded_file($_FILES['file']['tmp_name'], "upload/" . $name);
          echo "Stored in: upload/" . $name;
      } 

if you do this, then one of the two problems I see is the fact that you're no longer storing the file extension. so, you'll need to extract the file extension from $_FILES['file']['name'] and then attach it onto the end of $name.

the second problem is that you're just using a random number. a random number could be repeated, even if you put in 10 or 20 digits. a better way of doing this might be to store an MD5 hash of the filename, or an MD5 hash of the file's contents, or a call to microtime(), or a combination of all of those. using microtime() rather than time() will ensure that you allow multiple uploads to happen every second, and adding in an MD5 hash of the file's name would let you make sure that even multiple uploads could happen at the same exact time as long as the filenames were different. or the file contents. whichever.

or, you could just forget all of this and make a loop that just tacks a number onto the end of the filename if it exists, and you won't even need to worry about ever having a file overwriting another file, or failing because the file exists already.

ask questions if this doesn't make any sense to you!

[red_bull_NRG]

Thanks a ton, this helps a lot! How would I extract the extension from $_FILES['file]['name'[. Also, How would I do the md5 hash thing you're talking about?

[kows]

the md5() function turns a string into an MD5 hash (a string of 32 characters that is unique). you can use it like any other sort of string manipulation function:

$file = "whatever.jpg";

$newfilename = md5($file);

//produces something like "as90da8s9uh2ja02jk242radds" 

you can extract a file extension by using this handy function I made:

  function extractExtension($filename){
    //get the last occurrence of a period
    $l = strrpos($filename, ".");
    
    return substr($filename, $l);
  } 

when using this on a filename, it will return the period as well as the extension (".jpg" instead of "jpg"). thus, you could create a filename like so:

<?php
  //get extension
  $extension = extractExtension($_FILES['file']['name']);

  //get the exact current time
  $microsec = microtime(true);
  /* note: this would only work with PHP5!
   * see microtime() on php.net to see how to make an equivalent function for PHP4
   */

  //get hash of name and time
  $hash = md5($_FILES['file']['name'] . $microsec);

  //our new filename.
  $filename = $hash . $extension;
  //expect something like: 164d8fd38371885d6267e8fee5e6a344.png
?>

[red_bull_NRG]

Thanks! This helps a lot, it's all working now. However, could you maybe explain how that function you made works, because I'm a little confused as to what means what in the function. Thanks!

[SambaNeko]

strrpos() returns the index of the last occurrence of a character in a string. So if you put in...

$l = strrpos("example.jpg", ".");

Then $l is equal to the index of the last occurrence of . in "example.jpg", which is 7.

substr() returns a portion of a string starting from a particular index (and going through to the end of the string, unless you specify a different end point). Examples:

echo substr("hello world",0); //prints "hello world"
echo substr("hello world",3); //prints "lo world"
echo substr("hello world",5); //prints " world"

So you use the index you just obtained to get a substring containing your file extension.

return substr("example.jpg", $l); //returns ".jpg"

You could also consolidate the function a bit like so:

function extractExtension($filename){
  return substr($filename, strrpos($filename, "."));
}

[penagate]

you can also use:

pathinfo($filename, PATHINFO_EXTENSION)