Why won't this simple piece of code work?

[Jsn7821]

I have a script that I want to only allow .jpg, .gif and .png files to be uploaded to my server.

if ($file)
{
	$filename = $_FILES["file"]["name"];
	$filetype = strtolower($filename);
	$imagetype = substr($filetype, -4);
	if ('$imagetype' != '.jpg' || '.gif' || '.png')
	{
		echo "The image has to be .jpg, .gif or .png, yours is ";
		echo "$imagetype";
		DIE(" ");
	}
}

I get the file name, change it to lowercase, and check the last four characters. This should be really simple!! But for some reason it always gives the error message. I am going to run out of hair to tear out.

[bretticus]

Well, I'm in a hurry but you can't do the OR (||) statements the way you're doing them for one...why don't you try (an improve on it) this:

if ($file)
{
    $filename = $_FILES["userfile"]["name"];
    $filetype = $_FILES["userfile"]["type"];    

    if (isImage($filetype))
    {
        echo "The image has to be .jpg, .gif or .png, yours is ";
        echo "$imagetype";
        DIE(" ");
    }

function isImage($filetype)
{
	$extensions[] = "jpg";
	$extensions[] = "jpeg";
	$extensions[] = "gif";
	$extensions[] = "png";
	$isImage = false;
	foreach ($extensions as $extension) {
		if (stristr($filetype, $extension)) {
			$isImage = true;
			break;	
		}
	}
	return $isImage;
}
}

[mtmosier]

if ('$imagetype' != '.jpg' || '.gif' || '.png')

Heh... where to begin.

Well, first up, quotes aren't needed around $imagetype. But if you had used double quotes that part at least would be valid. When you use single quotes the string is not parsed for variable replacement by php. So it takes '$imagetype' as literally that text.

Also conditionals don't work the way you are trying to use them. You are trying to test for $imagetype not being jpg, gif, or png. What you're actually doing in this if statement is checking whether $imagetype is not equal to jpg, or if the text ".gif" is true, or if the text ".png" is true. When you test a non-boolean value for true/false it is converted to a boolean, and a non-empty string will be considered true.

You could do this with an if statement like this

if ($imagetype != '.gif' && $imagetype != '.jpg' ...)

Or you could use a switch statement

switch ($imagetype) {
    case '.gif':
    case '.jpg':
        break;
    default:
        ...
}

[Jsn7821]

Originally posted by mtmosier
Well, first up, quotes aren't needed around $imagetype. But if you had used double quotes that part at least would be valid. When you use single quotes the string is not parsed for variable replacement by php. So it takes '$imagetype' as literally that text.

Also conditionals don't work the way you are trying to use them. You are trying to test for $imagetype not being jpg, gif, or png. What you're actually doing in this if statement is checking whether $imagetype is not equal to jpg, or if the text ".gif" is true, or if the text ".png" is true. When you test a non-boolean value for true/false it is converted to a boolean, and a non-empty string will be considered true.

switch ($imagetype) {
    case '.gif':
    case '.jpg':
        break;
    default:
        ...
}

If you couldn't tell I'm a bit rusty in php 😉, I was actually trying to modify a script I had made a year ago.

However, could you (or anyone) explain how that switch works?

[Weedpacket]

Originally posted by Jsn7821
However, could you (or anyone) explain how that switch works?

[man]switch[/man], but I'd rather use [man]getimagesize[/man] because I don't trust those people out there with their file extensions.

[Jsn7821]

Originally posted by Weedpacket
[man]switch[/man], but I'd rather use [man]getimagesize[/man] because I don't trust those people out there with their file extensions.

I've been messing around a lot with getimagesize, and it has made my script a lot more secure except I ran into a problem.

I have a page where you can upload a file from your computer, and then it runs a series of checks on the image before it uploads.

getimagesize() only works on images that are uploaded, how could i check if its an image before I have the script upload it?

$filename = $_FILES["file"]["name"];
$imagetype = substr($filename, -4);
echo "Checking if image exists...";

if (getimagesize($filename))
{
echo "sucess<br><br>\n";
} else {
echo "nope, the image has to be a real image... yours is a $imagetype file.";
DIE(" ");
}

The error message says (obviously):

Warning: getimagesize($filename): failed to open stream: No such file or directory.

[mtmosier]

if (getimagesize($_FILES['file']['tmp_name']))

'name' is the name of the file as it was on the user's computer. 'tmp_name' is the full path to the temporary location of the uploaded file on the server. See the manual to find out what information is available for uploaded files.

It's worth noting that by the time your script starts running the file is already uploaded. It's just in a tempory location and will be deleted when your script completes if you don't copy/move it somewhere else.

[Jsn7821]

Originally posted by mtmosier

if (getimagesize($_FILES['file']['tmp_name']))

'name' is the name of the file as it was on the user's computer. 'tmp_name' is the full path to the temporary location of the uploaded file on the server. See the manual to find out what information is available for uploaded files.

It's worth noting that by the time your script starts running the file is already uploaded. It's just in a tempory location and will be deleted when your script completes if you don't copy/move it somewhere else. [/B]

So if someone uploads a 50MB file, it will be uploaded before my script can check if its too big? How can I stop this?

[bretticus]

Keep getting the emails for this post. BTW, that the hell is wrong with using...

$filetype = $_FILES["userfile"]["type"];

Notice the associate key 'type' to get the file type? Can this be exploited??

[superwormy]

You can't. At least not with PHP. PHP is server-side, and thus it can't do anything to the image unless the image is on the server.

Look into Javascript or Flash if you want to check the image size before uploading it.

[superwormy]

IIRC, all of the information in the $_FILES array is being passed by the clients computer, anyone with a little bit of programming knowledge could write a program/script to send you any type of file, but still have the 'type' key say whatever they wanted it to.

[bretticus]

thanks wormy, I'm so lazy I never checked into that (time to go update a bunch of code 😃 )

peace!

[mtmosier]

You would normally add a hidden field to your upload form to tell the browser the max file size it should send.

<input type="hidden" name="MAX_FILE_SIZE" value="1000000">

Of course this can't be trusted implicitly, but at least it cuts down on the problem for legit users.

Also there's a file upload size limit in the php.ini file, but I imagine that's only applied after the file is uploaded. Not sure.

[Jsn7821]

Since I don't think this question deserves it's own thread... its roughly the same topic of validation:

What is the best way to validate an audio clip? Or is that not possible due to being able to disguise files and such...