Pass variable from foreach to nested if

sleepydad

I am using a form to upload image files. The form contains 10 input fields sending all as an array.

<input type='file' name='projectphoto[0]' />
<input type='file' name='projectphoto[1]' />
...

I have the following in my script to test for file upload type.

$photo=$_FILES['projectphoto'];

foreach ($photo['type'] as $b) {
if ($b!='image/jpeg' && $b!='image/gif' && $b!='image/png') {
$_SESSION['success']=false;
header('location:admin.php');
exit;
}
}

The if() statement always returns FALSE. If I echo $b outside of the if() statement, it shows that the foreach() loop is doing its job. I cannot get $b to pass to the nested if().

Any assistance would be greatly appreciated.

sleepydad

Bunkermaster

Hi Sleepydad,

try to var_dump( $b ) once you're in the foreach. It may not contain what you are expecting.

Also, I'd define acceptable values for $b in an array to simplify the code and maintenance:

$acceptable_mime = array( 'image/jpeg' , 'image/gif' , 'image/png' );
/* some code */
foreach ( $photo['type'] as $b ) {
    if ( !in_array( $b , acceptable_mime  )) {
        $_SESSION['success']=false;
        header('location:admin.php');
        exit;
    }
}

sleepydad

Figured it out. I was getting the FALSE return because the foreach() loop was evaluating all ten keys in the array including those that were empty. I applied array_filter to the array to eliminate the empty elements and it works now.

bradgrafelman

Also note that the 'type' parameter is supplied by the user's browser and isn't checked by PHP.

Thus, I could easily upload 'my_new_virus.exe' and simply claim it's of type 'image/gif' and your script would be none the wiser.

sleepydad

So what's the best way to get the file type? I read about and tried fileinfo(), but couldn't figure out how to get it working on files pending upload. I was able to get the file type when using an absolute path, but cannot figure out how to do it otherwise.

bradgrafelman

sleepydad;11007257 wrote:
So what's the best way to get the file type?

Well, since you're specifically targeting images, one possibility might be to use [man]getimagesize/man and make sure it doesn't return FALSE. (If you wanted to further limit the upload to only JPEG, GIF, and PNG images, you could additionally check the IMAGETYPE_XXX constant returned in index 2.)

sleepydad;11007257 wrote:
I read about and tried fileinfo(), but couldn't figure out how to get it working on files pending upload. I was able to get the file type when using an absolute path, but cannot figure out how to do it otherwise.

What did you try? Note that you already have the absolute path for the uploaded file before you've moved it - it's in the "tmp_name" index (e.g. $_FILES['projectphoto']['tmp_name'][0]).

Also, note that PHP automatically deletes uploaded files that haven't been moved (e.g. via [man]move_uploaded_file/man) when the script has finished executing, so either you've omitted part of your actual code above or else you're immediately losing the uploaded files (even if they're valid).