GET/POST form file upload

pollocks

Hi there.

I'm new to PHP and anm trying to create a simple file upload. The script doesn't work:

<html>

<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<title></title>
<meta name="Description" content="">
<meta name="Keywords" content="">
<meta name="Author" content="">
<meta name="Generator" content="AceHTML 4 Pro">
</head>
<?php
function handleupload() {
if (is_uploaded_file($HTTP_GET_FILES['userfile']['tmp_name'])) {

$realname = $HTTP_GET_FILES['userfile']['name'];
print "<b>$realname</b> was uploaded successfuly to the upload directory";

print "";

copy($HTTP_GET_FILES['userfile']['tmp_name'], "/docs/dev");
} else {
echo "Possible file upload attack: filename
".$_FILES['userfile']['name'].".";
echo "Error returned is :".$HTTP_GET_FILES['userfile']['error']."";
}
}
?>
<body>
<?php
if ($HTTP_GET_VARS['act'] == "upload") {
handleupload();
}
?>
<form ENCTYPE="multipart/form-data" method="GET" action="file_upload.php?act=upload">
File:<INPUT TYPE="FILE" NAME="userfile" SIZE="35">
<input type="hidden" name="MAX_FILE_SIZE" value="10000000">
<input type="submit" value="Upload" name="B1">
Please click only <b>once</b> and wait for confirmation
</form>

</body>
</html>

I've tried using $POST, $GET, $HTTP_GET_VARS and $HTTP_POST_VARS with no success. I've tried this on my Win2k and NT servers (with register_globals = On and all file upload config settings set) and also on my ISP's UNIX box (don't know which OS, but PHP is definately installed and running simple web pages with <?php include... statements).

Please shed some light on this!!!

I'm getting nowhere quickly with this! I've also tried sending the post or get to another file that doesn't do the if($act= stuff

Also, any good PHP stuff to validate form entry with rather than using JavaScript??

Any help will be greatly appreciated.

Cheers,

Pollocks

(Glasgow, Scotland)😕 😕

daveyboy

Here's a few lines of code from a file I use to do the same. Works great.

 
if ( file_exists($HTTP_POST_FILES['f_logo'] ['tmp_name'])) {
               move_uploaded_file( $HTTP_POST_FILES['f_logo']['tmp_name'],
\t "data/".$_SESSION['url']."/school_logo.gif");
               echo "<div align='center'><h3>Bild erfolgreich hochgeladen!</h3></div><br>";
               $uploaded = 1;
        }

and...

<INPUT TYPE=\"file\" NAME=\"f_logo\" SIZE=45>

A quick comparison would suggest maybe using POST as the action for your form. I think URLs are limited to about 1K or so. I'm also using move_uploaded_file(). As always, check the directory permissions, though PHP will normally throw an error/warning if it can't read or write something.

pollocks

Hey!

Thanks for helping out.

I finally got this working on my Windows NT and Win2k boxes. I'm now battling with my ISP to get support on getting it working on their box :-(

Anyway, for anyone else who's interested, I thought I'd show you my code:

This is the form that posts the file:

<body>

<form ENCTYPE="multipart/form-data" method="POST" action="./file_process.php">
File:<INPUT TYPE="FILE" NAME="f_logo" SIZE="35">
<input type="hidden" name="MAX_FILE_SIZE" value="10000000">
<input type="submit" value="Upload" name="B1">
Please click only <b>once</b> and wait for confirmation
</form>

</body>
</html>

..and this is the file that processes the upload (it renames the uploaded file if it already exists in the destination directory!):

<body>
<?php
if ( file_exists($HTTP_POST_FILES['f_logo'] ['tmp_name']))
{
echo "<div align='center'><h3>File appears to have got to temp dir OK</h3></div><br>";
$filename=$_FILES['f_logo']['name'];
echo "Filename is: " . $filename . "<br>";
$tmp_name=$HTTP_POST_FILES['f_logo']['tmp_name'];
echo "Filename is: " . $tmp_name . "<br>";

$destinationpath="c://php//upload//".$filename;

$i = 1;
while (file_exists($destinationpath))
{
$destinationpath=$destinationpath.".".$i++;
echo "desinationpath is: ".$destinationpath;
}

if (move_uploaded_file($tmp_name, $destinationpath) )
{
	echo "<div align='center'><h3>File moved successfully</h3></div><br>";
	echo "<div align='center'><h3>Operation completed successfully<!/h3></div><br>";
}
else
{
echo "<div align='center'><h3>Moving the file failed!</h3></div><br>";
}

}
else
{
echo "HTTP POST failed. Perhaps the server is not set up?";
}
?>
</body>
</html>

.......................................................

I hope that somebody finds it useful!!
😃

Incubator

thanks 😃
I was looking for a long time for this 🙂
but there is one more thing: the uploaded file get the name ftp:\members.lycos........ instead of only the file name.
And I´m also looking for a way to attach a link to that uploaded file to a page.