image upload help

[sonicfusion]

i have this code which i have adapted slightly from a book, it works ok as it is but...

1. is there anyway i can add limitations to image width/height... i have no idea where to start here 🙁

2. how safe/secure is the code... im a little worried i will most prob add some htaccess password protection or alike will this be sufficient

3. i have the directory chmoded to 777, is this too much?
   [/list=1]

   the form...

   <form action="fileupload.php" method="post" enctype="multipart/form-data">
   <input type="hidden" name="MAX_FILE_SIZE" value="512000" />
   <p>Select file to upload: <input type="file" name="uploadedfile" /></p>
   <p><input type="submit" name="submit" value="Submit" /></p>
   </form>

   the uploady bit...🙂

   <?php
   if ($uploadedfile_type == "image/pjpeg" or $uploadedfile_type == "image/gif") {
     // Handle the file
   } else {
   echo("<p>Please submit a JPEG or GIF image file.</p>\n");
   }
   
   // Pick a file extension
   if ( "image/pjpeg" == $uploadedfile_type )
   $extension = ".jpg";
   else $extension = ".gif";
   
   // The complete path/filename
   $filename = $SERVER['DOCUMENT_ROOT'] . date("Y-m-d_H-i-s") . $extension;
   
   // Copy the file (if it is deemed safe)
   if (is_uploaded_file($uploadedfile) && copy($uploadedfile, $filename)) {
     echo("<p>File stored sucessfully as $filename.</p>");
     } else {
       echo("<p>Could not save file as $filename!</p>");
   }
   ?>

   thank you all in advance. your help is very much apricieated!😃

[gaucho]

Hi,
1. There is a way to find out about height and width of an image. You have to have gd, etc installed, then you could use imagesx or imagesy to find out about the size. Check the php manual for this Image Functions
2. The script is pretty insecure, you will have to introduce some kind of validation to verify size and type of the file. The extension on it's own is just a hint. I could append .jpg to any executable or code file. The file header normally contains the info needed to classify the file. Retrieve them and validate them against your restrictions. You could start here Filesystem Functions.
3. 755 should be enough since it is the webserver that is writing the file to the filesystem and he normally should own directories in wwwroot and descendants.
Hope this helps

best regards

gaucho

[rr1024]

File upload and/or image display class if you would like to check it out let me know