file upload

[Anon]

I am trying to create a file upload but when I go to upload files, I get this message:

 "Warning: Unable to create '/upload': Permission denied in /home/httpd/html/construction/upload.php on line 22"

I've changed the permissions in the /upload folder to nobody but that doesn't help.

In a file called maintain_users.php, I have the following code:

<FORM ENCTYPE="multipart/form-data" ACTION="upload.php" METHOD="POST">
<INPUT TYPE="hidden" name="MAX_FILE_SIZE" value="100000">
Send this file: <INPUT NAME="userfile" TYPE="file">
<INPUT TYPE="submit" VALUE="Send File">
</FORM>

The next file, upload.php, where the upload is passed to contains the following code:

<?php
/ Userland test for uploaded file. /
function is_uploaded_file($filename) {
if (!$tmp_file = get_cfg_var('upload_tmp_dir')) {
$tmp_file = dirname(tempnam('', ''));
}
$tmp_file .= '/' . basename($filename);
/ User might have trailing slash in php.ini... /
return (ereg_replace('/+', '/', $tmp_file) == $filename);
}

               if (is_uploaded_file($userfile)) {
                   copy($userfile, "/upload");
               } else {
                   echo "Possible file upload attack: filename '$userfile'.";
               }
               ?>

Any ideas?

Thanks,

Jamie

[Anon]

it is not getting the path of the uploaded file. simple as that, run this code and check it out
<?
$directory = "upload";
$path1= dirname($PATH_TRANSLATED)."/$directory/";
// assign our path in a form PHP for Windows understands
$dest = $path1.$filename_name;

// Free the memory allocated

Copy("$filename",$dest) ;

 // Destroy the file now we've copied it

unlink($filename);

?>

cheers

kalyan

[Anon]

Klyan,

I'm getting the following error messages when I try your code.

Warning: Unable to open '' for reading: No such file or directory in /home/httpd/html/construction/upload.php on line 20

Warning: Unlink failed (No such file or directory) in /home/httpd/html/construction/upload.php on line 22

I think the problem is with the variables $file_name and $filename. Where are they supposed to be defined? What is $file_name and $filename. My form input name is userfile. Should I rename $file_name to $userfile ???

Jamie

[Anon]

yeah u should rename that.

Should I rename $file_name to $userfile ??? RENAME IT

if u use yahoo. MSN or ICQ u can message me

my nick in yahoo and MSN is kalyanjit

cheers

[Anon]

kalyan,

I tried re-naming $file_name to $userfile. That does not work. From further reading, I found out that $file_name is a variable automatically assigned by php to the file that has been uploaded, upon upload. This variable stores the actual file name. $filename is the the temporary name given by php to the file uploaded.

In upload.php, I inserted some print statements to print out $filename_name and $filename but got no results. It looks like for some reason, the files I'm trying to upload are not being uploaded........ My next step was to look in the php.ini file and see what types of file extensions are supported. I found a link to an extensions folder but I could not find a list of supported extensions.

I've tried uploading MS Word, Excel, text, and .php files, all with no luck.

[Anon]

My problem was with the variables I was using. I needed to name them $userfile and $userfile_name.

Thanks for your help Kalyan.

Jamie

[Anon]

name this file upload.php

check it out

cheers kalyan

if($submit)
{
<?
set_time_limit(60);
$directory = "upload";
$path1 = dirname($PATH_TRANSLATED)."/$directory/";
// assign our path in a form PHP for Windows understands
$dest = $path1.$file_name;

echo("$file");
echo("<br>");
echo("$file_name");
echo("<br>");
echo("$file_size");
echo("<br>");
Copy("$file",$dest) ;

 // Destroy the file now we've copied it

unlink($file);
?>

}

<form method="post" action="upload.php" enctype="multipart/form-data">
<table width="200" border="0" align="center">
<tr>
<td>&nbsp;</td>
<td>
<input type="file" name="file">
</td>
</tr>
<tr>
<td>&nbsp;</td>
<td>
<input type="submit" name="Submit" value="upload">
</td>
</tr>
<tr>
<td>&nbsp;</td>
<td>&nbsp;</td>
</tr>
</table>
</form>

[Anon]

Klyan,

Thanks for the help.

I've already implemented something very similar to your example, except I didn't have the time limmit set.

My ICQ # is: 1027

[e-mail]

Jamie