Help with move_uploaded_file

[UserNotFound]

HI, I am relatively new to php and am attempting to have an uploaded file to saved into the Images folder. However whilst the entry is input correctly into the database, the image itself is not uploaded. I am using 1and1. Below is my php.ini:

register_globals = 0

allow_url_fopen = 1

session.bug_compat_warn = 0

memory_limit = 128M 
max_execution_time=3600 
post_max_size = 128M
upload_max_filesize= 128M 

upload_tmp_dir = '/temp'

And below is my PHP code:

<?php

include ('connection.php');
session_start(); 
  $pic=$HTTP_POST_FILES['previewImage']['tmp_name'];
 $destination='/Images';
 $date = date('d-m-Y');

$postarticle = "INSERT INTO articles VALUES (NULL,'$_POST[title]',CURDATE(), '{$_SESSION['ID']}','Images/$_POST[previewImage]', '$_POST[preview]', '$_POST[video]', '$_POST[content]', '$_POST[additionalInformation]', '$_POST[type]')";
if (mysql_query($postarticle,$conn)){
	move_uploaded_file($pic,$destination.$HTTP_POST_FILES['previewImage']['name']);
	  header("Location: index.php");
}
else
{
	header("Location: {$_SERVER['HTTP_REFERER']}");
}
?>

Hope someone can find the solution 🙂

[Weedpacket]

UserNotFound wrote:

 $destination='/Images'; 

This is probably wrong, unless you really do have an "/Images" directory right off your file system's root (next to the "/temp" directory).

[DeadlySin3]

This isn't exactly using your code - but this is an image upload script that I wrote some years ago. It doesn't save anything to a db, but it'll give you a general idea as to what to do!

<?php
# vars.php
/*
 *  Maximum Size an image may be
 *
 *  $maxImageSize
 *
 *  51200 = 50 KB
 *  512000 = 500 KB
 *
 */

$maxImageSize = "512000"; 



/*
 *  Path Information
 *
 *  1.) $file_dir
 *
 *  2.)$file_url
 *
 *  1.) full path ex /home/user/public_html/images
 *
 *  2.) full url ex http://www.site.com/images
 *
 *  NO TRAILING SLASH!!
 * Directory to move images to should be chmod 777
 *
 */

$file_dir = "/home/paul/public_html/FREE/upload/images";
$file_url = "http://localhost/~paul/FREE/upload/images";

/*
 *  Defining accepted Image Types
 *
 *  Add more like shown below: 
 *
 *  $acceptedImageType[] = "type";
 *
 */


$acceptedImageType = array ( "pjpeg", "pjpg", "jpg", "jpeg", "gif", "png", "x-png", "PNG", "x-xbitmap" );
$acceptedImageType[] = "x-bmp";

/*
 *  Defining a Page's Own URL
 *
 *  $self=$_SERVER['PHP_SELF'];
 *
 */

$self=$_SERVER['PHP_SELF'];
?>

<?php
# upLoadForm.php

include("vars.php");
// In PHP versions earlier than 4.1.0, $HTTP_POST_FILES should be used instead
// of $_FILES.

foreach( $_FILES as $file_name => $file_array ) 
{
echo "name: ".$file_array['name']."<br />\n";
echo "type: ".$file_array['type']."<br />\n";
echo "tmp_name: ".$file_array['tmp_name']."<br />\n";
echo "error: ".$file_array['error']."<br />\n";
echo "size: ".$file_array['size']."<br />\n";
// print_r($_FILES);

$tmp_name = $file_array['tmp_name'];

if( strstr( $tmp_name, "/tmp/" ) ) {
    $tmp_name = str_replace("/tmp/", "", $tmp_name); # strip location from name
}

foreach ( $acceptedImageType as $acceptThis ) {
if(is_uploaded_file( $file_array['tmp_name'] ) && $file_array['type'] == "image/$acceptThis" ) {

$size=$file_array['size'];
if($size > $maxImageSize)
{
exit("The image is too large in size.");
}

move_uploaded_file( $file_array['tmp_name'], "$file_dir/".$tmp_name)
or die("Couldn't Copy");
echo "<img src=\"$file_url/".$tmp_name."\">";
echo "<br />\n\n";

} // End Foreach loop 2

} // End IF statement

} // End Foreach loop 1

?>

<form action="<?php echo "$self"; ?>" enctype="multipart/form-data" method="POST">
<input type="hidden" name="MAX_FILE_SIZE" value="<?php echo "$maxImageSize"; ?>">
<input type="file" name="fupload">
<br /><br />
<input type="submit" value="Upload">
<br />
</form>

I really hope this helps you out!

[bradgrafelman]

@: Make sure you ignore the part about checking the file type in DeadlySin3's code above, since that does nothing to ensure that the actual type of the file is being checked (I could easily upload 'my_nasty_virus.exe' and claim it is of type 'image/jpeg').

Then again, your SQL query is vulnerable to SQL injection attacks, so perhaps it's not even your concern if you get viruses uploaded and corrupt data inserted into your database.

[DeadlySin3]

bradgrafelman;11014705 wrote:

@: Make sure you ignore the part about checking the file type in DeadlySin3's code above, since that does nothing to ensure that the actual type of the file is being checked (I could easily upload 'my_nasty_virus.exe' and claim it is of type 'image/jpeg').

Then again, your SQL query is vulnerable to SQL injection attacks, so perhaps it's not even your concern if you get viruses uploaded and corrupt data inserted into your database.

Yeah this code isn't really meant to be used for production. It's just a very basic example of how to play around with uploading images and exploring file array information as well as location of images upon upload. While not the most efficient/secure code ever written, I think it's a good example of how to do what he's looking to do!

[sneakyimp]

Assuming your filenames (i.e., $HTTP_POST_FILES['previewImage']['name']) do not start with a slash (/), then it looks to me like you are trying to create a bunch of image files at the root of your server. E.g., if your file was named MyFile.jpg, then your code would try to copy it to /ImagesMyFile.jpg instead of /Images/MyFile.jpg. I'd be willing to bet your move file attempt is failing. You could use all kinds of sanity-checking functions like [man]is_writable[/man] to make sure the destination is writeable before you up and try to write that destination.

[bradgrafelman]

sneakyimp makes a good point about the missing directory separator (in addition to Weedpacket's suggestion that '/Images' probably isn't even right in the first place). Another possible issue is whether $HTTP_POST_FILES even exists. I'm betting that on the average PHP installation nowadays, it won't. (And even if it did exist, you shouldn't be using it.)