Help with upload file

alvarogtc

Hi guys i have a script that i use to upload 1 picture and 1 video in flv, the problem is this dont check for file extension so anybody can upload a php file or anything by the form, i have tried to implement a code to check the files extension but i failed, if anyone can help me i apreciate..


if($acao== "insertbd"){
$dir = "../img";
//echo "$dir";
$uploaddir = "$dir/";      

  if($imagem != "none") {          

      if (@copy($_FILES['imagem']['tmp_name'], $uploaddir . $_FILES['imagem']['name'])) {             

   $imagem1 = $_FILES['imagem']['name'];              

  //echo "<strong>$imagem1</strong> enviada com sucesso!<BR>";            

    }       

 }       

 if($imagem2 != "none") {            

    if (@copy($_FILES['imagem2']['tmp_name'], $uploaddir . $_FILES['imagem2']['name'])) {            

    $imagem3 = $_FILES['imagem2']['name'];            

    //echo "<strong>$imagem3</strong> enviada com sucesso!<BR>";          

      }   

     }
$sql = "INSERT INTO $tabela VALUES ('$id','$nome','$email','$imagem1','$imagem3','$tema')";$sql2 = mysql_query($sql, $conexao);
$mgs = "<b>$palavra</b> Inserida com Sucesso!";}
?>

kannan

hi...

alvarogtc..

if u have problem in uploading files means just try the following code.....

use 2 files....
1.one for selecting the file to upload (UPLOAD1.PHP)
2.code to upload the file... (UPLOAD.PHP)

[U]UPLOAD1.PHP[/U]
html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Untitled Document</title>
</head>

UPLOAD.PHP

<?php
if ($FILES["file1"]["error"] > 0)
{
echo "Error: " . $FILES["file1"]["error"] . "<br />";
}
else
{
echo "Upload: " . $FILES["file1"]["name"] . "<br />";
echo "Type: " . $FILES["file1"]["type"] . "<br />";
echo "Size: " . ($FILES["file1"]["size"] / 1024) . " Kb<br />";
// echo "Stored in: " . $FILES["file"]["tmp_name"];
}
if (file_exists("h:/qvoice/" . $FILES["file1"]["name"]))// it is used to check the same file is exist
{
echo $FILES["file1"]["name"] . " already exists. ";
}
else
{
move_uploaded_file($FILES["file1"]["tmp_name"],
"h:/qvoice/" . $FILES["file1"]["name"]); // here the distination folder path & it may anything
echo "Stored in: " . "h:/qvoice/" . $_FILES["file1"]["name"]; // it is for our reference
}
?>

CHANGE THE DISTINATION FOLDER NAME WHERE U WANT...

TRY IT.... IT WORKS TO ME....

IF U WANT TO FIND THE FILE IS WHICH TYPE
Firt u read the file name and using strpos funtion find the positon of where(.) comes...

after that using condition check wheather it is mp3 or what file extension u want...