checking file uploads for size and type

crawfd

I'm trying to take the array of images from form and check them for file types and size. As of now it's not working and if I input a file over 10kb it still posts without displaying the $message variable. I think I may have to break apart the array before I start checking for size, etc. but I'm not really sure.

Thanks


if(isset($_POST[s1]))
{


//manage files
if(empty($_FILES[images]))

{

$max_size = 10000; 
$is_uploaded_file = true; 
$size = true; 
$type = true;


	if  (!is_uploaded_file($_FILES[images][name]
		)) {$is_uploaded_file = FALSE;} 

	if ($_FILES[images][size] > $max_size) 
			{  
    		$size = FALSE;  
    		$message[] = 'The file is too big. You must keep image size under 10kb.';  			
		}

	if (($_FILES[images][type] != 'image/pjpeg') && ($_FILES[images][type] != 'image/jpeg')) 
			{  
    		$type = FALSE; 
      		$message[] = 'Sorry, only .jpg formats allowed. '; 
			}

	if (!$is_uploaded_file || !$size || !$type) 
			{   
    		$message[] = 'Upload has failed.';                  
			}

} 

	if(!empty($_FILES[images]))
		{	



	while(list($key,$value) = each($_FILES[images][name]))
	{
		if(!empty($value))
		{
			$NewImageName = $t."_".$value;
			copy($_FILES[images][tmp_name][$key], "images/blingpics/".$NewImageName);

			$MyImages[] = $NewImageName;
		}
	}

	if(!empty($MyImages))
	{
		$ImageStr = implode("|", $MyImages);
	}


$q1 = "insert into class_catalog set 
							MemberID = '$_SESSION[MemberID]',
							ProductType = '$_POST[ProductType]',
							url = '$_POST[url]',
							CategoryID = '$_POST[CategoryID]',
							ProductName = '$_POST[ProductName]',
							Description = '$_POST[Description]',
							images = '$ImageStr',
							Price = '$_POST[Price]',
							DatePosted = '$t',
							DateExp = '$_SESSION[AccountExpDate]',
							FeaturedStatus = '$_POST[sp]' ";
//echo $q1;
	mysql_query($q1) or die(mysql_error());



//get the posted offers
$q1 = "select count(*) from class_catalog where MemberID = '$_SESSION[MemberID]' ";
$r1 = mysql_query($q1) or die(mysql_error());
$a1 = mysql_fetch_array($r1);

if($_SESSION[MaxOffers] == '0' || $_SESSION[AccountStatus] == 'inactive' || $a1[0] >= $_SESSION[MaxOffers])
{
		header("location:more.php?st=1");
		exit();

}
}



header("location:AddAsset.php");

exit();




//______________Display Form Below


} else {  ?>


<form method=post action="<?php echo $_SERVER['PHP_SELF']?>" name="PostForm" onsubmit="return CheckOffer();" enctype="multipart/form-data">

//form here

<?   //print error messages here
if ($message) {	
echo "<div align=\"left\"><font color=red></b><br />\n";
	foreach ($message as $key => $value) {
	echo "$value";
	}
	echo "<br></font><br>";
	} ?>
 <input type=file name="images[]" size=31>
        <br> <input type=file name="images[]" size=31>
        <br> <input type=file name="images[]" size=31> 
<input type=submit name=s1 value="Submit">
</form>

<? } ?>

Weedpacket

Well, a few things I see is a stray } there (after tidying up the formatting), you're using while instead of foreach, and using [man]getimagesize[/man] would be a more reliable way of determining if an uploaded file is a JPEG; but the main issue I note is that while you add an error message to the $message[] array, but that's all you do if there's an error. You still go ahead with the copy, you still go ahead with the insert, and you still go ahead with the redirect.

crawfd

I'm not sure how to build the statement to logically negate or include the insert depending on file size, ext. criteria.

The issue I'm facing is how to construct the logic so that each file is separated from the array and analyzed by my file upload criteria.

Heeelp.

Weedpacket

Another three things I've just noticed. You only look at the content of the $FILES array when it's empty; you need to check that $FILES['images']['tmp_name'] is the uploaded file, because that's the name it's saved on your server under; and after writing all your checks assuming that there is only one file being uploaded, your code to copy the files assumes that there is a whole array of files being uploaded (though you go back to assuming that there is only one file when you try to insert it).

On the other hand; here is the logic I think you're trying to implement:

if(there is a form submission)
{
	if(there is a file being uploaded)
	{
		create an array of messages
		if(the uploaded filename is invalid)
		{
			add a message to the array
		}
		if(the file is too large)
		{
			add a message to the array
		}
		if(the file has the wrong type)
		{
			add a message to the array
		}
		if(the message array is empty)
		{
			copy the file
			do the database insertion.
			do something with posted offers
			if(whatever that's supposed to be)
				header(more)
			else
				header(asset);
			exit.
		}
	}
}

Display the form. If the message array exists, it's because there was a file
upload. If the message array is not empty, there were errors.

And on the gripping hand, if thinking logically is your weak spot (and it looks like it is) then you might want to consider taking up something other than programming.

crawfd

I integrated the logic in the form below however no matter what file I upload I get the array of error messages so I'm assuming the error check isn't working...


<?

if(isset($_POST[s1]))
{

//manage files
if(!empty($_FILES[images]))
{

$max_size = 10000; 
$is_uploaded_file = true; 
$size = true; 
$type = true;


		if  (!is_uploaded_file($_FILES[images][name]
		)) {$is_uploaded_file = FALSE;} 

		if ($_FILES[images][size] > $max_size) 
			{  
    		$size = FALSE;  
    		$message[] = 'The file is too big. You must keep image size under 10kb.';  			}

		if (($_FILES[images][type] != 'image/pjpeg') && 						($_FILES[images][type] != 'image/jpeg')) 
			{  
    		$type = FALSE; 
      		$message[] = 'Sorry, only .jpg formats allowed. '; 
			}

		if (!$is_uploaded_file || !$size || !$type) 
			{   
    		$message[] = 'Upload has failed.';                  
			}


	if(!empty($message))
	{

	while(list($key,$value) = each($_FILES[images][name]))
	{
		if(!empty($value))
		{
			$NewImageName = $t."_".$value;
			copy($_FILES[images][tmp_name][$key], "images/blingpics/".$NewImageName);

			$MyImages[] = $NewImageName;
		}
	}

	if(!empty($MyImages))
	{
		$ImageStr = implode("|", $MyImages);
	}


$q1 = "insert into class_catalog set 
							MemberID = '$_SESSION[MemberID]',
							ProductType = '$_POST[ProductType]',
							url = '$_POST[url]',
							CategoryID = '$_POST[CategoryID]',
							ProductName = '$_POST[ProductName]',
							Description = '$_POST[Description]',
							images = '$ImageStr',
							Price = '$_POST[Price]',
							DatePosted = '$t',
							DateExp = '$_SESSION[AccountExpDate]',
							FeaturedStatus = '$_POST[sp]' ";
//echo $q1;
	mysql_query($q1) or die(mysql_error());





//get the posted offers
$q1 = "select count(*) from class_catalog where MemberID = '$_SESSION[MemberID]' ";
$r1 = mysql_query($q1) or die(mysql_error());
$a1 = mysql_fetch_array($r1);

if($_SESSION[MaxOffers] == '0' || $_SESSION[AccountStatus] == 'inactive' || $a1[0] >= $_SESSION[MaxOffers])
{
		header("location:more.php?st=1");
		exit();

}




header("location:AddAsset.php");

exit();

}
}
}


<form method=post action="<?php echo $_SERVER['PHP_SELF']?>" name="PostForm" onsubmit="return CheckOffer();" enctype="multipart/form-data"> 

//form here 

<?   //print error messages here 
if ($message) {     

echo "<div align=\"left\"><font color=red></b><br />\n"; 
    foreach ($message as $key => $value) { 
    echo "$value"; 
    } 
    echo "<br></font><br>"; 
    } ?> 
<input type=file name="images[]" size=31> 
        <br> <input type=file name="images[]" size=31> 
        <br> <input type=file name="images[]" size=31> 
<input type=submit name=s1 value="Submit"> 
</form> 

?>

crawfd

I still can't seem to get this to function properly, any help out there.