you should probably read this because it can explain this better than i can:
http://www.php.net/manual/en/features.file-upload.php
the first thing you do is create a form with file inputs. you have to add the enctype bit in the <form> tag or you won't find any files in the php script that handles the form posting. i'm not certain but i also think it has to have method=post.
<form method="post" action="upload_handler.php" enctype="multipart/form-data">
<input type="file" name="file_input"><br>
<input type="submit" name="submit" value="submit">
</form>
then there is your script to handle the post. note that in the form i said it would be called upload_handler.php. this script should do a bunch of things:
- make sure the file is an acceptable size, type, etc. the more you check, the more secure your site will be
- try to put the file in the right place and if it cannot, report errors so you can figure out what the hell went wrong
- store the appropriate information in your database so you know where the file is located, etc.
generally, you should probably save all of your image files to some directory on your server. because you are letting users upload files to your server, you need to be careful about what you let them upload. DO NOT let them upload anything like EXE files or PHP files if you can help it or they might hack you or your users.
i usually create some folder for all uploaded images and define it with a constant (like UPLOAD_FOLDER in the following script. you have to make sure that apache and/or php has permission to write the contents of that tolder. to do this, either ask your system administrator or check your server documentation about how to change file system permissions.
when the form above submits to upload_handler.php, PHP should define information related to the file in a superglobal array called $FILES. It's like $GET or $_POST but a little different.
this code is intended for linux systems and i have NOT tested it but might be all you need.
// UPLOAD_HANDLER.PHP
// this can be a relative path name but i prefer absolute ones
define('UPLOAD_FOLDER', '/home/sneakyimp/html/images/uploads');
$acceptable_filetypes = array();
$valid_filetypes = array("image/jpeg", "image/pjpeg", "image/gif", "image/x-png");
$valid_extensions = array(".jpg", ".jpeg", ".jpe", ".gif", ".png");
$valid_image_types = array(1,2,3);
if (isset($_POST['submit'])) {
$filename = $_FILES['file_input']['name'];
if ($filename != '') {
$this_file_ok = true;
// check all the params of the object
$filetype = $_FILES['file_input']['type'];
$tmp_name = $_FILES['file_input']['tmp_name'];
$fileerror = $_FILES['file_input']['error'];
$filesize = $_FILES['file_input']['size'];
$this_file_ok = true;
if (empty($tmp_name) || empty($filesize) || !file_exists($tmp_name)) {
$errors[] = 'Uploaded file could not be found.';
$this_file_ok = false;
}
// check the file size must be less than the maximum size (includes/constants.php)
if ($filesize >= MAX_UPLOAD_SIZE) {
$errors[] = "The file '" . $filename . "' is too big!";
unlink($tmp_name);
$this_file_ok = false;
}
// check the mime type
if (!in_array($filetype, $valid_filetypes)) {
$errors[] = 'The file ' . $filename . ' was not one of the permitted types ( GIF, JPEG, or PNG only).';
$this_file_ok = false;
}
// one last check for error field
if ($this_file_ok) {
switch ($fileerror) {
case UPLOAD_ERR_OK:
break;
case UPLOAD_ERR_INI_SIZE:
$errors[] = 'The file ' . $filename . ' exceeds the upload_max_filesize directive (' . ini_get('upload_max_filesize') . ').';
break;
case UPLOAD_ERR_FORM_SIZE:
$errors[] = 'The file ' . $filename . ' exceeds the MAX_FILE_SIZE directive that was specified in the HTML form.';
break;
case UPLOAD_ERR_PARTIAL:
$errors[] = 'The file ' . $filename . ' was only partially uploaded.';
break;
case UPLOAD_ERR_NO_FILE:
$errors[] = 'No file was uploaded for ' . $filename;
break;
case UPLOAD_ERR_NO_TMP_DIR:
$errors[] = 'No temporary folder.';
break;
case UPLOAD_ERR_CANT_WRITE:
$errors[] ='Failed to write file to disk';
break;
default:
die('an unrecognized error was encountered.');
} // switch $fileerror
} // if file otherwise ok
// by now we should be ok...PLACE THE FILE IN THE UPLOAD FOLDER
if (is_uploaded_file($tmp_name)) {
// IMPORTANT - this will over write any file in the UPLOAD_FOLDER with the same name as $filename
move_uploaded_File($tmp_name, UPLOAD_FOLDER . '/' . $filename)
or die('uploaded file move FAILED');
}
} else {
die('filename was empty');
} // if name not empty
// you will probably need to store more information here but this should give you the basic idea
// then you put the uploaded filename in your database
$sql = "INSERT INTO images SET filename='" . mysql_real_escape_string($filename) . "'";
mysql_query($sql)
or die('query failed);
} else {
die 'no data was posted';
}
