form error

slimjim

I have the form below, works fine but just problem i am not understanding how to fix problem.

I get these 2 errors if i just go to the page and do not upload anything, all i do is just click on submit to get the error !!
I know it has something to do with the fact i didnt upload a picture.

Errors :
Warning: Unable to access in /home/www/html/picture.php on line 14

Warning: getimagesize: Unable to open '' for reading. in /home/www/html/picture.php on line 16

Below is the code

$image_max_width="155";
$image_max_height="93";

if ($submit) {

$query = "UPDATE trial SET member_pic = '$member_pic' WHERE user_id = '$user_id'"; 
$result = mysql_query($query) or die( "ERROR: " . mysql_error() . "\n"); 

copy($picture, "/home/www/html/images/" . $picture_name);[COLOR=orange]//line 14[/COLOR]

$size = GetImageSize($picture);[COLOR=orange]//line 16[/COLOR]

if ($size[0] > $image_max_width) { 
  echo "Your image should be no wider than " . $image_max_width . " Pixels<br><a href=\"memberpic.php\">Go Back</a>\n"; 
  exit;
} 

if ($size[1] > $image_max_height) { 
  echo "Your image should be no higher than " . $image_max_height . " Pixels<br><a href=\"memberpic.php\">Go Back</a>\n"; 
  exit;
}

echo "<br>File uploaded successfully<br>";
echo "file name: $picture_name<br>\n";  

echo "temp file: $picture<br>\n"; 
echo "file size: $picture_size<br>\n"; 
echo "file type: $picture_type<br>\n"; 
echo "<br>\n"; 
echo "<img src=../eimages/$picture_name><br>\n"; 

} 

?> 
<form enctype="multipart/form-data" method="post" action="<?php echo $PHP_SELF ?>"> 
<br> 
<input type="hidden" name="member_pic" size="25" value="eimages/<?php echo $picture_name; ?>"> 
<input type="hidden" name="$user_id" value="<?php echo $user_id; ?>">
<br> 
picture
<br> 
<br> 
<input type="File" name="picture" size="25"> 
<br><br> 
<input type="submit" name="submit" value="Upload"> 
</form>
[/PHp]

nunomira

hi,

that's because no image is uploaded, and the script tries to use the variable "image", which doesn't exist

like you test to see whether $submit exists or not, you should do the same with $image.

in my server I'd do:

if (isset($_POST['submit'])) { 
	if(isset ($_POST['picture']))
	{
		// your code here
	}
	else
	{
		echo "no picture uploaded";
	}
}

but if your code works, you just need:

if (isset($submit)) { 
	if(isset ($submit))
	{
		// your code here
	}
	else
	{
		echo "no picture uploaded";
	}
}
// maybe without the isset()...

slimjim

Well it didnt work, i still get the same two errors if i hit submit without uploading a picture...

Here is how i changed the code :

$image_max_width="155"; 
$image_max_height="93"; 

if (isset($_POST['submit'])) {  

    if(isset ($_POST['picture'])) 
    { 

$query = "UPDATE trial SET member_pic = '$member_pic' WHERE user_id = '$user_id'"; 
$result = mysql_query($query) or die( "ERROR: " . mysql_error() . "\n"); 

copy($picture, "/home/www/html/images/" . $picture_name);//line 14 

$size = GetImageSize($picture);//line 16 

if ($size[0] > $image_max_width) { 
  echo "Your image should be no wider than " . $image_max_width . " Pixels<br><a href=\"memberpic.php\">Go Back</a>\n"; 
  exit; 
} 

if ($size[1] > $image_max_height) { 
  echo "Your image should be no higher than " . $image_max_height . " Pixels<br><a href=\"memberpic.php\">Go Back</a>\n"; 
  exit; 
} 

echo "<br>File uploaded successfully<br>"; 
echo "file name: $picture_name<br>\n";   

echo "temp file: $picture<br>\n"; 
echo "file size: $picture_size<br>\n"; 
echo "file type: $picture_type<br>\n"; 
echo "<br>\n"; 
echo "<img src=../eimages/$picture_name><br>\n"; 

} 
    else 
    { 
        echo "no picture uploaded"; 
    } 
} 

?> 
<form enctype="multipart/form-data" method="post" action="<?php echo $PHP_SELF ?>"> 
<br> 
<input type="hidden" name="member_pic" size="25" value="eimages/<?php echo $picture_name; ?>"> 
<input type="hidden" name="$user_id" value="<?php echo $user_id; ?>"> 
<br> 
picture 
<br> 
<br> 
<input type="File" name="picture" size="25"> 
<br><br> 
<input type="submit" name="submit" value="Upload"> 
</form>

nunomira

Sorry, my fault!

I tested it with GET, and it worked...

The same doesn't happen with POST.
You need to use the $FILES array instead:

if (isset($_POST['submit'])) {   

    if(isset ($_FILES['picture']['name']) && $_FILES['picture']['name'] !== "") 
    { 
		// code here
	} 
    else 
    { 
        echo "no picture uploaded"; 
    } 
}

slimjim

That did work thank you, at one time i was using something simular but i must have had it wrong.

I do have two more questions. Now i would think with me limiting the height and width of an image i wouldnt have to worry about size. But if i should have to do that, how would i add it to the code ?

How can i make the form more safe for security, from people uploading some dangerous file or even typing something that could cause havoc ?

Any ideas would be great !!

nunomira

maximum file size is defined in the php .ini file

It may also be defined (using a lower value) with a hidden field: example 18-1

I think you should check for the file type/extension the user is uploading.

Search the forums and the manual for more details.

slimjim

I just noticed something really wierd.
If i upload a piicture, it does go into the directory but !

it ( member_pic ) value doesn't show up in the databse ...

But if i upload a second picture...

the first ( member_pic ) value is in there but not the current one

What is wrong ?