image upload and place in DB

andersstudio

I am trying to upload some data and an image, place the image on my server, and capture/place the filename of the image in the db. I've read through many of the posts regarding this topic, but was not able to troubleshoot my problem.

My form is simple and contains the

enctype="multipart/form-data"

in the form and the file piece is coded as:

<input type="file" name="label" id="file" />

Here is my handler code:

	$region = $_POST['region'];	
	$producer= $_POST['producer'];
	$bottle = $_POST['bottle'];	
	$description= $_POST['description'];

$tech_info_sheet = "tech sheet";	// not in form yet
$shelf_talker= "shelf"; // not in form yet


/*if ((($_FILES["label"]["type"] == "image/gif") || ($_FILES["label"]["type"] == "image/jpeg") || ($_FILES["label"]["type"] == "image/pjpeg")) && ($_FILES["label"]["size"] < 20000))
  {
	if ($_FILES["label"]["error"] > 0){
		echo "Return Code: " . $_FILES["label"]["error"] . "<br />";
	}
	else{

echo "Upload: " . $_FILES["label"]["name"] . "<br />";
			echo "Type: " . $_FILES["label"]["type"] . "<br />";
			echo "Size: " . ($_FILES["label"]["size"] / 1024) . " Kb<br />";
			echo "Temp label: " . $_FILES["label"]["tmp_name"] . "<br />";

		if (label_exists("upload/" . $_FILES["label"]["name"])){
			echo $_FILES["label"]["name"] . " already exists. ";
		 }
		else{
		  move_uploaded_file($_FILES["label"]["tmp_name"],
		  "upload/" . $_FILES["label"]["name"]);
		  echo "Stored in: " . "testing/upload/" . $_FILES["label"]["name"];
		  $label = $_FILES["label"]["name"];
		}
	}
}
else{
	echo "Invalid file";
}*/

  // Configuration - Your Options
  $allowed_filetypes = array('.jpg','.gif','.bmp','.png'); // These will be the types of file that will pass the validation.
  $max_filesize = 524288; // Maximum filesize in BYTES (currently 0.5MB).
  $upload_path = '/testing/uploads/'; // The place the files will be uploaded to (currently a 'files' directory).

   $filename = $_FILES['label']['name']; // Get the name of the file (including file extension).
   $ext = substr($filename, strpos($filename,'.'), strlen($filename)-1); // Get the extension from the filename.

   // Check if the filetype is allowed, if not DIE and inform the user.
   if(!in_array($ext,$allowed_filetypes))
      die('The file you attempted to upload is not allowed.');

   // Now check the filesize, if it is too large then DIE and inform the user.
   if(filesize($_FILES['label']['tmp_name']) > $max_filesize)
      die('The file you attempted to upload is too large.');

   // Check if we can upload to the specified path, if not DIE and inform the user.
   if(!is_writable($upload_path))
      die('You cannot upload to the specified directory, please CHMOD it to 777.');

   // Upload the file to your specified path.
   if(move_uploaded_file($_FILES['label']['tmp_name'],$upload_path . $filename))
         echo 'Your file upload was successful, view the file <a href="' . $upload_path . $filename . '" title="Your File">here</a>'; // It worked.
      else
         echo 'There was an error during the file upload.  Please try again.'; // It failed :(.









include("connection/wof_db.inc.php");	// PREVENT THE DATA FROM BEING DUPLICATED BY REFRESHING OR HITTING SUBMIT MORE THAN ONCE
$sql = "SELECT bottle
		FROM portfolio
		WHERE bottle = \"$bottle\"";

$result = mysql_query($sql,$dbc);

// PAGE EXISTS 	
if(mysql_num_rows($result) != 0){		
	print("<h3>$bottle already exists</h3>");
}
else{

	// CREATE THE PORTFOLIO ITEM
	$sql = "INSERT INTO `portfolio` (`region`, `producer`, `bottle`, `description`, `label`, `tech_info_sheet`, `shelf_talker`) 
			VALUES (\"$region\", \"$producer\", \"$bottle\", \"$description\", \"$label\", \"$tech_info_sheet\", \"$shelf_talker\");";

	$result = mysql_query($sql,$dbc);

	if(mysql_affected_rows() == 0){
			user_error("An error occurred when creating the page.<br />Query: $sql", E_USER_WARNING);
	}
	else{
		print("<h3>$bottle was successfully added to the Portfolio.</h3>");
	}
}

Any ideas why the image does not upload and why I am not seeing any of the echo's?

Thanks

azo

Have you tried:

if(move_uploaded_file($_FILES['label']['tmp_name'],$upload_path . $filename)) {
echo 'Your file upload was successful, view the file <a href="' . $upload_path . $filename . '" title="Your File">here</a>'; // It worked.
} else {
echo 'There was an error during the file upload. Please try again.'; // It failed 🙁.
}

azo

andersstudio

I updated the code to include all curly braces, but the problem still existed. It was failing at:

if(!is_writable($upload_path)){
      	die('You cannot upload to the specified directory, please CHMOD it to 777.');
 	}

I changed the permission to the php handler to 777 and it still did not work. I then realized that the permission needed to change for the upload_path folder. Once I changed this to 777, it worked.

Is 777 and the rest of these restrictions secure enough (there is a session variable that is carried throughout the CMS so only users logged in can access the page to upload images)?

// Configuration - Your Options
    $allowed_filetypes = array('.jpg','.gif','.bmp','.png'); // These will be the types of file that will pass the validation.
    $max_filesize = 524288; // Maximum filesize in BYTES (currently 0.5MB).
    $upload_path = '/home7/winesoff/public_html/testing/uploads/'; // The place the files will be uploaded to (currently a 'files' directory).

$filename = $_FILES['label']['name']; // Get the name of the file (including file extension).
print("$filename");
$ext = substr($filename, strpos($filename,'.'), strlen($filename)-1); // Get the extension from the filename.

// Check if the filetype is allowed, if not DIE and inform the user.
if(!in_array($ext,$allowed_filetypes)){
  	die('The file you attempted to upload is not allowed.');
}
 // Now check the filesize, if it is too large then DIE and inform the user.
if(filesize($_FILES['label']['tmp_name']) > $max_filesize){
  	die('The file you attempted to upload is too large.');
}
 // Check if we can upload to the specified path, if not DIE and inform the user.
if(!is_writable($upload_path)){
  	die('You cannot upload to the specified directory, please CHMOD it to 777.');
}

if(move_uploaded_file($_FILES['label']['tmp_name'],$upload_path . $filename)) {
	echo 'Your file upload was successful, view the file <a href="' . $upload_path . $filename . '" title="Your File">here</a>'; // It worked.
} 
else {
	echo 'There was an error during the file upload. Please try again.'; // It failed .
}