PHP upload form image type check and filesize check

-=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- (c) WidthPadding Industries 1987 0\|377\|0 -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=- -=+=-
Socoder -> Web Development -> PHP upload form image type check and filesize check
Sat, 07 Oct 2006, 15:03
HoboBen	Heya, I've found this code to upload images, which works, unlike all the many others which dislike me for some reason. Unfortunatly, with this one I can't figure out how to restrict the filesize or the file types to image/jpg, whereas with others I think I could've, if I'd figured out why they weren't doing the basics first. Here's the code... Can you tell me the commands and variables I need to be looking at here, please? <? if($_POST["action"] == "Upload Image") { unset($imagename); if(!isset($_FILES) && isset($HTTP_POST_FILES)) $_FILES = $HTTP_POST_FILES; if(!isset($_FILES['image_file'])) $error["image_file"] = "An image was not found."; $imagename = basename($_FILES['image_file']['name']); if(empty($imagename)) $error["imagename"] = "The name of the image was not found."; if(empty($error)) { $newimage = "store/" . $imagename; $result = @move_uploaded_file($_FILES['image_file']['tmp_name'], $newimage); if(empty($result)) $error["result"] = "There was an error moving the uploaded file."; } } ?> <form method="POST" enctype="multipart/form-data" name="image_upload_form" action="<?$_SERVER["PHP_SELF"];?>"> <input type="file" name="image_file" size="20"> <input type="submit" value="Upload Image" name="action"> </form> <? if(is_array($error)) { while(list($key, $val) = each($error)) { echo $val; echo " \n"; } } ?> --v Muchly thank you! -=-=- blog \| work \| code \| more code
Sat, 07 Oct 2006, 16:19
tnt23	I don't know much php, so I don't know where this would go (and you might already know this) but couldn't you just put in somewhere: $maxsize=whatever; if(filesize($imagename)<=$maxsize) //allow the file to be uploaded --v that's all I've got. sorry. jnk will probably know where to put that. -=-=- What if this were not a hypothetical question?
Sat, 07 Oct 2006, 16:29
HoboBen	Hi, tnt. My main problem was looking for the filesize function. Whatcha know, it looks like the filesize function is called "filesize"! I'll try that. Thanks! -=-=- blog \| work \| code \| more code
Sat, 07 Oct 2006, 16:38
HoboBen	It worked, in a way... The only thing is, I'm checking before the file is uploaded, and therefore doesn't exist. If I check after, it's already uploaded and I can't stop it. I could delete it after I've uploaded, but I think that maybe a bit silly, after people wait for their 20MB bitmap to upload for half an hour, and it also means more bandwidth consumption. \|edit\| Error message is: Warning: filesize() [function.filesize]: Stat failed for caution.gif (errno=2 - No such file or directory) \|edit\| -=-=- blog \| work \| code \| more code
Sat, 07 Oct 2006, 16:55
tnt23	the error pretty much just says it doesn't exist, cause I just realized that for filesize() to work the file has to be on the server. i got it now use $_FILES['image_file']['size'] instead. \|edit\| you can also set a default in the php.ini file (upload_max_filesize), but I'm not sure how that would work, as far as letting the user know that the file is too big. \|edit\| -=-=- What if this were not a hypothetical question?
Sat, 07 Oct 2006, 17:05
HoboBen	Perfect! I'm going to have to google the $_FILES bit, because that was the most confusing part for me. I'll see if I can do the image type comparing by myself, and I'll post back my results. -=-=- blog \| work \| code \| more code
Sat, 07 Oct 2006, 17:24
HoboBen	Hey, I got on pretty well. Check it out, a Jpg uploader! (Image bin freshly emptied) I'm using this to provide the "upload your picture" part of something I hope to create for my friends as an alternative to myspace. Hence, "my face". Now to figure out how the hell I use MySQL! Will be posting source... -=-=- blog \| work \| code \| more code
Sat, 07 Oct 2006, 17:33
tnt23	I uploaded a text file that I changed the extension to jpg and it worked. I have no idea how to check the real file format, but I know myspace, imageshack, photucket, etc. all do it. -=-=- What if this were not a hypothetical question?
Sat, 07 Oct 2006, 17:36
HoboBen	What do you mean by "it worked"? I see just a url, but in view source, it contains text. I think the server does it automatically. -=-=- blog \| work \| code \| more code
Sat, 07 Oct 2006, 17:40
tnt23	I mean imageshack, photobucket, myspace, etc. don't let you upload the file at all. -=-=- What if this were not a hypothetical question?
Sat, 07 Oct 2006, 17:41
HoboBen	Ah. Doesn't matter too much though - I can use it to transfer text files by uploading from any computer, which will be pretty good. -=-=- blog \| work \| code \| more code
Sat, 07 Oct 2006, 17:48
tnt23	I guess it could be a security risk, I couldn't get javascript to work, but someone probably can. It's probably not that big an issue but I'm just thinking about the worst that can happen. -=-=- What if this were not a hypothetical question?
Sat, 07 Oct 2006, 17:57
HoboBen	Well, I'll keep working on it. I need to make sure people can't overwrite existing files with files that have the same filename... But it's 1 in the morning now... Maybe tomorow! -=-=- blog \| work \| code \| more code
Sat, 07 Oct 2006, 17:58
tnt23	right, timezone difference...
Sun, 08 Oct 2006, 03:27
Jayenkai	Right, first thing's first.. I don't know! I tried, but couldn't get it working! Hence why you still can't upload Workshop entries.. I should get back to doing that, really, shouldn't I! And yes, it is a rather dangerous situation.. If someone uploads an .exe with a virus, disguised as a jpg, all hell could break loose. Your best bet, is to run every image through a JPG image scaler, setting the new scale to 100%, so it at least checks that the image is an image.. --- Jay's Undiscovered Site Stuff : Hover mouse over User's name = User's Current Time (assuming they set it right in their profile) -=-=- ''Load, Next List!''
Sun, 08 Oct 2006, 06:06
HoboBen	I don't know! I tried, but couldn't get it working! Hence why you still can't upload Workshop entries.. You couldn't get yours working, or mine? I'll be posting the finished source and stuff anyway, so maybe you can adapt mine for your own needs? I know how to check for zip files, and I'm assuming rars check in the same way. Anyway, will run some disguised exe tests now... -=-=- blog \| work \| code \| more code
Sun, 08 Oct 2006, 06:23
Jayenkai	Mine.. I couldn't get mine working.. I'm sure yours would probably work, but mine would need to upload both a .zip and .jpg at the same time, and check each one, and then warn me to test it, too! I'll bother doing it someday! -=-=- ''Load, Next List!''
Sun, 08 Oct 2006, 06:26
HoboBen	Just add an extra form field for the jpg. Anyway, I can't get my C++ compilers to work at all today, so I can't test exes from Blitz, because they're way more than 20kb for a hello world file! So, I'm just temporarily moving the upload limit up by adding several zeros... -=-=- blog \| work \| code \| more code
Sun, 08 Oct 2006, 06:34
HoboBen	helloworld.jpg didn't run! Which means that the server is correctly set up to say, "Hey, jpgs are images" rather than let the browser decide. Anyway, Jay, I'll get you an upload form working, if you want me to attempt it for you... Only thing is, I got a load of coursework due tomorow, and wednesday, for many, many subjects, and probably a lot more for friday. It'll be done when I can get some time to do it. -=-=- blog \| work \| code \| more code
Sun, 08 Oct 2006, 06:43
Jayenkai	No, no.. It's ok, I'll get round to it.. Just the lack of WW entries kinda put me off bothering to do it, is all.. -=-=- ''Load, Next List!''
Sun, 08 Oct 2006, 10:37
HoboBen	Okee... Finished uploader code. Checks if files already exist, too... Can we have a PHP/JavaScript/HTML/XML/SHTML code snippit section too, please? <html> <head> <title>Upload JPEG / JPG image</title> </head> <body> <? if($_POST["action"] == "Upload Image") { unset($imagename); if(!isset($_FILES) && isset($HTTP_POST_FILES)) $_FILES = $HTTP_POST_FILES; if(!isset($_FILES['image_file'])) $error["image_file"] = "An image was not found."; $imagename = basename($_FILES['image_file']['name']); if(empty($imagename)) $error["imagename"] = "The name of the image was not found."; if(empty($error)) { if(!(file_exists("store/" . $imagename))) { if ($_FILES['image_file']['size'] < 20480) { if ($_FILES['image_file']['type'] == "image/jpeg") { $newimage = "store/" . $imagename; $result = @move_uploaded_file($_FILES['image_file']['tmp_name'], $newimage); if(empty($result)) $error["result"] = "There was an error moving the uploaded file."; } else { $error["result"] = "Jpg/Jpeg images only, please."; } } else { $error["result"] = "Filesize limit of 20kb exceeded."; } } else { $error["result"] = "Image already exists!"; } } } ?> <form method="POST" enctype="multipart/form-data" name="image_upload_form" action="<?$_SERVER["PHP_SELF"];?>"> <input type="file" name="image_file" size="20"> <input type="submit" value="Upload Image" name="action"> </form> <? if(is_array($error)) { while(list($key, $val) = each($error)) { echo $val; echo " \n"; } } ?> <hr> <p>Access the <a href="/store/">image bin</a>.</p> </body> </html> --v Now, I can easily in the space of five minutes, if all goes well, fix it for a jpg plus a rar/zip... If you want it. -=-=- blog \| work \| code \| more code
Sun, 08 Oct 2006, 10:43
tnt23	\|quote: HoboBen\| Can we have a PHP/JavaScript/HTML/XML/SHTML code snippit section too, please? \|quote\| file access/misc? -=-=- What if this were not a hypothetical question?
Sun, 08 Oct 2006, 10:44
HoboBen	Yeah, I was thinking file access, but I'd quite like a whole web based section. -=-=- blog \| work \| code \| more code
Sun, 08 Oct 2006, 15:01
Jayenkai	Added the Web Dev section to Code Snippets For the record, if you want me to notice stuff, kinda Bold it or something, so that I do! If tnt hadn't have \|quoted\| (must do that too) it, I would've missed it! -=-=- ''Load, Next List!''