Register Globals And Uploading

tejwa206

Hello,

I am very frustrated and I am missing the point to register globals at least when it comes to uploading files.

If I declare a variable in the code already do I still need to use $GET, $POST to retreive it?

Anyway... My problem lies with the below code works perfectly fine with register globals off. Files are uploaded perfectly fine. When I turn them on everything goes to crap. Any ideas?

 if (!($connection = @ mysql_pconnect($hostName, 
                                     $username, 
                                     $password)))
    showerror();

 if (!mysql_select_db("ylddb", $connection))
    showerror();

 // Was a file uploaded?
 if (is_uploaded_file($userfile))
 {

   switch ($userfile_type)
   {
      case "image/gif";       
         $_POST['mimeName'] = "GIF Image";     
         break;
      case "image/jpeg";          
         $_POST['mimeName'] = "JPEG Image";
         break;
      case "image/png";       
         $_POST['mimeName'] = "PNG Image";
         break;
      case "image/x-MS-bmp";       
         $_POST['mimeName'] = "Windows Bitmap";
         break;
      default: 
         $_POST['mimeName'] = "Unknown image type";
   }

   // Open the uploaded file
   $file = fopen($userfile, "r");

   // Read in the uploaded file
   $fileContents = fread($file, filesize($userfile)); 

   // Escape special characters in the file
   $fileContents = AddSlashes($fileContents);
 }  
 else
  $fileContents = NULL;


 $insertQuery = "INSERT INTO files VALUES (NULL, '2',
     '1', '$mimeName', '$fileContents')";

 mysql_query($insertQuery, $connection);


 print_r($_FILES);

vaaaska

Yes, you do need $_POST.

Unless you extract($_POST) then you can grab $whatever_string_you_need.

Or you could simply go $the_file_name = $_POST instead.

tejwa206

Say I grab the $userfile = $_POST['userfile']; from the html form right?

Now internally how exactly do I get the userfile_type variable and the fileContents variable to actually register and post with register_globals on?

There aren't many good tutorials. If you know of any please let me know.

I have read a few but all have been with register_globals off.

tejwa206

I guess my main problem is the fact that I can't get the file to actually upload into a database with register_globals on.

I made one comment to modify at the top

$userfile = $_POST['userfile'];

So in theory I would think that the userfile would be all that needs to be done. Grant it in the script there are other variables but those variables are for the script itself there are no queries associated with it internally so it should not be a security problem the code should work as is.

what am I missing?