file uploading with illegal characters on the filename

Squiggles

Hi all.

I'm creating a file uploading system for a project, and I came across this problem: whenever I upload a file that has a filename containing illegal characters, it truncates the filename from the instance of the illegal character onwards, so, in effect, the filename 'birdie's-heart.jpg' ends up as 's-heart.jpg' when it's uploaded.

Am I missing something? Since I'm assuming the end-users aren't that knowledgeable, I need a good approach for this. Need help on this matter.

Thanks in advance.

Sayian

Thank the People at microsoft for allowing "Illegal Char's" to be used as filenames ...

quicknik

Hi,

use a database to store a relation files orignal name <-> file name on server
where filename on server can be something like md5(uniqueid()).

cheers,
nikolas

Squiggles

hmmm, not sure what you mean, nikolas. please elaborate... 🙂

quicknik

after uploading the file rename it to something like md5(uniqueid).
Store the random name and its corresponding realname into a databasetable.

|af34324ef12321....|my il"legalf/ilename.pdf|

when a user requests "my il"legalf/ilename.pdf" lookup its filesystem name and serve the file...

oh stop may be i missed something: did you mean you don'T even get to know it's originalname since it is getting lost during upload?
regards,
Nikolas

Squiggles

Here's the scenario: when I have a filename something like "file'name.jpg", when this is uploaded, I end up with only 'name.jpg' during the upload. The original name is lost because the name gets truncated during the upload. the problem doesn't occur when the filename follows legal naming procedures such as filename.jpg. What I need is "file'name.jpg" instead of only "name.jpg".

quicknik

oh ok i see...mhmmm are magic quotes enabled? did you try to save the file name to a regular hidden form field via js ?
bye,
nikolas

Squiggles

Sorry, I'm not familiar with the approach. Pardon me. I may be a programmer, but I'm not that much familiar with file management yet. 🙁

quicknik

hi,
i played around a little and the following is what i get, when i try to upload a file named illegal (dump of $_FILES)
seems ok to me.
Array
(
[testfile] => Array
(
[name] => test\'asfdds.txt
[type] => text/plain
[tmp_name] => /tmp/phpKeloQl
[error] => 0
[size] => 0
)

)

check the output of php_info() and look for
magic_quotes_gpc
should be enabled.

bye,
nikolas

Squiggles

hmmm... strange. my magic quotes is enabled, but the problem is still there. I think the problem only happens when you use a single quote on the filename (i.e. file'name)

quicknik

can you post the whole code? may be there is something else you missed
i did my testing using this:

<html>
<head>
</head>
<body>
<pre>
<?
print_r($_FILES);
?>
</pre>

<form name="testform" method="post" enctype="multipart/form-data" action="<?=$PHP_SELF?>">
<input name="testfile" type="file" size="25">
<input name="speichern" type="submit" value="Speichern">
</form>
</body></html>

Squiggles

<FORM action="proc/libraryUpload.proc.php" method="post" enctype="multipart/form-data">
<P>Browse for File:</P>
<INPUT name="docUpload" type="file" id="docUpload">
</FORM>

<?
echo addslashes($docUpload);
//echo $FILES['docUpload'] ['tmp_name'];
echo $FILES['docUpload'] ['name'];
echo addslashes($FILES['docUpload'] ['name']);
echo $FILES['docUpload'] ['type'];

move_uploaded_file ($FILES['docUpload'] ['tmp_name'],
"../../docs/{$FILES['docUpload'] ['name']}")

Squiggles

The snippet works in transferring the file, but the name gets screwed up.

quicknik

looks like almost the same...
did you try my ...to make sure that we did not miss some stupid things 😉?
bye,
nikolas

Squiggles

yep... it generated the same thing:

Array
(
[testfile] => Array
(
[name] => s-heart.jpg
[type] => image/jpeg
[tmp_name] => D:\WINDOWS\TEMP\php92.tmp
[error] => 0
[size] => 32984
)

)

Squiggles

How about a renaming alternative--a javascript perhaps--that I can inject to get the job done?

quicknik

hi,

seems to be a browser/php configuration issue.
would you please post the whole output of phpinfo and browser version ...
so i can take more deep view.
bye,
nikolas

Squiggles

here you go... 🙂

Squiggles

btw, the browser is firefox 1.0.6

quicknik

hi,

ok besides i am using a unix system and yours is windows i
found the following differences

variables_order EGPCS
output_buffering no value

don't know if they are relevant ..but give it a try ...
bye,
nikolas