There are a few different ways you can't restrict file size, other than checking the file size like you do in your script, and those other ways of doing it would result in the file not being uploaded.
1. html
<input type="hidden" name="MAX_FILE_SIZE" value="100" />
<input name="file" type="file" />
I don't know if behaviour when filesize exceeds the limit is defined. But I'd expect the form to either not be submitted at all, or the file stripped from the post request.
This limit can obviously be circumvented since user's can forge their own post requests instead of using the form you provided them with.
php.ini directive: post_max_size
Max size of the entire post request, including uploaded files. I.e. this value must be greater than upload_max_filesize for upload_max_filesize to make any sense at all.
Not certain here either, but I'd guess the entire post request data would be discarded.
php.ini directive: upload_max_filesize
If the file is too large, the file is discarded - not the metainformation! Which means that you can check $FILES['d1_image']['name'] and see what the filename was on the users side, etc.
What you won't get however, is a valid filename from
$FILES['d1_image']['tmp_name']. The file was discarded, which means there is no file to find (I'm guessing tmp_name will be the empty string, or null).
Then you do some logically shady things like
$size=filesize($_FILES['d1_image']['tmp_name']);
if ($size > MAX_SIZE*150) {
filesize returns... filesize or FALSE (see [man]filesize[/man]), so $size = false;
if (false > SOME_INTEGER) will needs to be typecast in some way. In this case, I'd put my money on the boolean being cast into an integer. Boolean false always casts to 0 while boolean true always casts to 1.
So, you will have
if (0 > SOME_INT_GREATER_THAN_150)
which is the same as
if (false)
which in turn means you assume the filesize is ok. But you don't even have a file. So you should check that filesize doesn't return false: !== false. And you should always always always check that a function that return special values on error didn't just do that! That doesn't just go for mysql_query and the like, it holds for each and every function that might return something indicating an error.
For all functions that do not do this, but have some other means of indicating error, such as calling a specific function, you should always always always check that no error occurred by this extra call.
And in the case of file upload, there is actually a specific value to check which indicates status of the file upload, and obviously it will even tell you if file size was too big UPLOAD_ERR_INI_SIZE (upload_max_filesize) or UPLOAD_ERR_FORM_SIZE (size specified in the html form). There is also a special value for OK, so all you need to do is see if you get this value before you proceed to do everything else.
So the first thing you do is check if file upload was ok, by inspecting the value indicating this and only this! Going through file upload should make it clear how to deal with this.
Also, you should restructure your code. Presently you do things like
if ($size_is_unacceptable)
{
$error = true;
}
copy($too_big_file, $someplace_permanent);
echo 'file is too big';
You should only move the file to a permanent location if you intend to keep it.
Please note that you didn't replace your call to copy with move_uploaded_file, you just put move_uploaded_file after the call to copy, so now you do pretty much the same thing twice, once without checking that the file actually was uploaded, and once without checking it.
