[Resolved] restrict file upload by file extension

[revez2002]

Hello,

When I run the following script, it returns the else conditional. However, the extension displayed "Extension: $ext" is accurate, and should return the if. There is obviously something in this script that I am overlooking.

revez2002

// Define the extensions that will be permitted for upload
  $allowed_ext = "txt, doc, pdf, xls"; 

// Validate the type of file based on its extension
  $extension = pathinfo($_FILES['userfile']['name']);
  $extension = $extension[extension];
  $allowed_files = explode(", ", $allowed_ext);
    for($i = 0; $i < count($allowed_files); $i++) {
      if ($allowed_files[$i] == "$extension") {
        $continue_upload_status = "yes";
      } else {
        echo "Problem: This file type cannot be uploaded<br>"; 
        echo "Extension: $extension<br>";
        exit;				  

      } 
    }

[planetsim]

You have

$ext = $ext[ext];

Which should be

$ext = $ext['extension'];

[revez2002]

I made the change suggested as well as a couple of others (see original post), but I get the same result.

[rehfeld]

your logic is flawed.

the way your looping and comparing, you are requiring that a single ext be the same as EVERY possible ext, which, is not possible.

instead, do this

if (!in_array($extension, $allowed_files)) {
    die('bad ext');
}

[revez2002]

I will try the aforementioned suggestion. However, I was able to achieve the result I was looking for by using the following switch:

// Validate the type of file based on its extension
switch($_FILES['userfile']['type']) {
case 'application/vnd.ms-excel': // .xls files (MS Excel)
$permit_upload="yes";
break;

case 'application/msword': // .doc files (MS Word)
$permit_upload="yes";
break;

case 'application/pdf': // .pdf files (Adobe PDF's)
$permit_upload="yes";
break;
}

  if($permit_upload != "yes") {
    echo "Problem: This file type cannot be uploaded<br>"; 
    echo "File Name = ".$_FILES['userfile']['type'];		
    exit;
  }