Uploading Images... Should I be worried?

[Fritz]

I am getting ready to offer the option for folks to upload their faces to our personals section...

here is what I envision.

upload and automatically name the file the same as their userid.jpg - with a pending approval flag.

upload to a WWW directory.

QUESTIONS:

1.Can anyone point me to a good tutorial for jpg. and gif, limiting file size... ?
2. Will it be a security issue (and how so) If I allow them to upload to one of our www. directories? Do I really HAVE to have them upload to a NON www. directory and then move it? why?

any thoughts/ exerience on this issue is much appreciated.

[planetsim]

Ive actually never heard of you having to move files from a folder then to the www directory.

You should use $FILES which can get you the filesize of the file. Use explode or better yet $FILES to get the type.

jpg is image/pjpg i think

[hearn]

Here's some code that I use on my site to limit the upload size of the user's input and copy the file to a new directory:

$move_path = "C:\\ServerRoot\pics"; 

	if (is_uploaded_file($_FILES['userfile']['tmp_name'])) { 
		$path = pathinfo($userfile);
		$filename = $path['basename'];

		$length = strlen($userfile_name);

		for ($a=$length; $a>0; $a--) {
			if ($userfile_name[$a]==".") {
				$start = $a+1;
				break;
			}
		}

		$filesize = filesize($userfile)/1000;
		$extension = substr($userfile_name, $start, $length);

		if (strtoupper($extension)!="JPG" and strtoupper($extension)!="GIF") {
			echo "$extension<BR />";
			echo "That is not a valid picture format for this site.  You are only allowed to upload";
			echo " Jpeg and gif images with the extension jpg or gif for this site.";
			exit;
		} else if ($filesize>200) {
			echo "Your filesize is too large.  Please try reducing your image size before uploading your picture.";
			exit;
		}

		if (file_exists("C:\\ServerRoot\\" . $id . ".JPG")) {
			unlink("C:\\ServerRoot\\" . $id . ".JPG");
		} 

		if (file_exists("C:\\ServerRoot\\" . $id . ".GIF")) {
			unlink("C:\\ServerRoot\\" . $id . ".GIF");
		}

		$new_name = $id;
		$new_name .= ".";
		$new_name .= $extension;

		copy("$userfile", "$move_path/$new_name") or die("Couldnt Upload Picture");
		echo "<BR />";
		echo "<B>Your Picture Was Uploaded Successfully:</B>";
		echo "<BR /><BR />";
	}