Upload Script

[Ryodox]

I'm working on an upload script that will upload a file and also enter a MySQL row for the file. However, when I try to upload it, I get the error "Error: File is zero length.". This doesn't happen when I'm running the script on my localhost. What could be the problem?

<?
	include('template.html');
	include('mysql_connect.php');

print "<h4>Upload a Map</h4>\n";

if ($_GET['go'] == 'true')
{
	$current_dir = "download/maps/";
	$mapname = $_POST['mapname'];
	$title = $_POST['title'];
	$style = $_POST['style'];
	$physics = $_POST['physics'];
	$description = $_POST['description'];
	$released = $_POST['released'];
	$userfile = $_FILES['userfile']['tmp_name'];
	$userfile_type = $_FILES['userfile']['type'];
	$userfile_size = $_FILES['userfile']['size'];
	$userfile_name = $_FILES['userfile']['name'];
	$upfile = $current_dir.$userfile_name;

	if ($userfile == 'none')
	{
		die("<p class=\"error\" align=\"justify\">Error:&nbsp; No file uploaded.</p>\n");
	}

	if ($userfile_size == '0')
	{
		die("<p class=\"error\" align=\"justify\">Error:&nbsp; File is zero length.</p>\n");
	}

	if (!is_uploaded_file($userfile))
	{
		die("<p class=\"error\" align=\"justify\">Error:&nbsp; Possible file upload attack.</p>\n");
	}

	if (!@copy($userfile, $upfile))
	{
		die("<p class=\"error\" align=\"justify\">Error:&nbsp; Could not move file into directory.&nbsp; (".$userfile.", ".$upfile.")</p>\n");
	}

	print "<p align=\"justify\">File uploaded successfully.</p>";

	move_uploaded_file($userfile, $upfile);

	$fp = fopen($upfile, "r");
	$contents = fread ($fp, filesize ($upfile));

	fclose ($fp);

	$fp = fopen($upfile, "w");

	fwrite($fp, $contents);
	fclose($fp);

	print "<p align=\"justify\">Successfully uploaded file.</p>\n";
	print "<p align=\"justify\">URL of uploaded file:</p>\n";
	print "<input type=\"text\" size=\"100\" value=\"".$upfile."\" readonly />\n";

	// Insert MySQL row

	$query = "INSERT INTO `maps` (`mapname`, `title`, `style`, `physics`, `description`, `released`, `size`, `filename`) VALUES ('".$mapname."', '".$title."', '".$style."', '".$physics."', '".$description."', '".$released."', '".$userfile_size."', '".$userfile_name."')";

	if (mysql_query($query))
	{
		print "<p align=\"justify\">Successfully inserted MySQL row.</p>";
	}
	else
	{
		print "<p class=\"error\" align=\"justify\">Error:&nbsp; Could not run query (".mysql_error().").</p>\n";
	}
}
else
{
?>

<form enctype="multipart/form-data" action="upload_map.php?go=true" method="post">

<table width="75%" class="darkborder" align="center">
	<tr>
		<td width="50%" class="blue" align="left">Mapname:</td>
		<td width="50%" class="blue" align="left"><input type="text" name="mapname" size="10" maxlength="25" />
	</tr>
	<tr>
		<td width="50%" class="blue" align="left">Title:</td>
		<td width="50%" class="blue" align="left"><input type="text" name="title" size="25" maxlength="50" />
	</tr>
	<tr>
		<td width="50%" class="blue" align="left">Style:</td>
		<td width="50%" class="blue" align="left"><select name="style"><option value="1">Defrag</option><option value="2">Freestyle</option></select>
	</tr>
	<tr>
		<td width="50%" class="blue" align="left">Physics:</td>
		<td width="50%" class="blue" align="left"><select name="physics"><option value="1">VQ3</option><option value="2">CPM</option></select>
	</tr>
	<tr>
		<td width="50%" class="blue" align="left">Description:</td>
		<td width="50%" class="blue" align="left"><textarea name="description" rows="5" cols="25"></textarea>
	</tr>
	<tr>
		<td width="50%" class="blue" align="left">Released:</td>
		<td width="50%" class="blue" align="left"><input type="text" name="released" size="10" maxlength="10" value="YYYY-MM-DD" />
	</tr>
	<tr>
		<td width="50%" class="blue" align="left">Upload:</td>
		<td width="50%" class="blue" align="left"><input type="file" name="userfile" />
	</tr>
	<tr>
		<td width="100%" class="blue" colspan="2" align="center"><input type="submit" value="Upload File" class="button" />
	</tr>
</table>

</form>

<?
	}

include('template-end.html');
?>

(Also, I didn't write the entire upload bit, that was a friend who made it)

[section31]

take a look at your files array...

echo "<pre>";
print_r($_FILES);
echo "</pre>";

[Frederick]

You will get better results using the copy() function for you upload. No matter which way you attack this issue, your limitations are set by the upload_max_filesize.

$current_dir = "$Root_Path/download/maps";

$copyfile = @copy($userfile,"$current_dir/$userfile_name");
if (!$copyfile) { echo "Failed to upload file\n"; }
else {
    // Do your mysql queries
}