Does this line of code add the new file name to the path?

chrisj

I have this code (below) where an image file is chosen, a new file name is generated, and the newly named file is moved to upload/ folder.

Does this line of code combine the new file name with where the newly-named file was moved to?

$file_location = '<a href="http://www.--.com/upload/' . $newfilename . '">http://www.--.com/upload/' . $newfilename . '</a>';


$allowedExts = array("gif", "jpeg", "jpg", "png");
	$temp = explode(".", $_FILES["file"]["name"]);
	$extension = strtolower( end($temp) );
	if (  $_FILES["file"]["size"] < 2000000
	&& in_array($extension, $allowedExts) )
	{
	if ($_FILES["file"]["error"]!= 0)
	{
	echo "Return Code: " . $_FILES["file"]["error"] . "<br>";
	} else {
	$length = 20;
	$randomString = (time());
	$newfilename = $randomString . "." . $extension;
	move_uploaded_file($_FILES["file"]["tmp_name"], "upload/" . $newfilename );
	[B]$file_location = '<a href="http://www.--.com/upload/' . $newfilename . '">http://www.--.com/upload/' . $newfilename . '</a>';[/B]
	}
	} else {
	echo "Invalid upload file";
	}

NogDog

Only if this script is running in the web document root directory, since the "upload" directory you move it to is relative to the script's location on the file system. If that's not a given, then you could use:

move_uploaded_file($_FILES["file"]["tmp_name"], $_SERVER['DOCUMENT_ROOT'].'/upload/' . $newfilename);

chrisj

Thank you for your message.
Do you know of any way to somehow grab that link/path prior to Submit?
so, the file's path can be automatically entered into a field on the Form?

NogDog

Not sure I follow you on that last question. Do you want the user to dictate where on the web server the file will be stored? (Normally I would say that sounds iffy, unless it's some sort of site administrator page?) If you do, then you'd probably need to set the desired directory path in a separate form input field, and then be careful to validate/sanitize it so that a malicious user cannot store a file in places it shouldn't be.

chrisj

Thanks for your message. No the user won't dictate where the file is stored. All files will go to upload/ folder.
I'd like the script to somehow grab the files link/path, so it can be entered automatically and hidden into a Form field

Weedpacket

chrisj wrote:
I'd like the script to somehow grab the files link/path, so it can be entered automatically and hidden into a Form field

Allowing page authors to pre-specify filenames to automatically upload user files with those names was dropped last century as it proved to be a major security risk. Giving a <input type="file"> element an initial value is forbidden by the spec, and attempting to set it via JavaScript raises a Security Exception.

Even if the user supplies the filename, the path should not be part of what is submitted as this too is a security vulnerability.

sneakyimp

If your intention is to somehow remember or preserve the original name of the file that the user uploaded, you can always use a database. You can take the uploaded file and generate a new unique filename for it using [man]uniqid[/man] and then store the original filename along with that uniqid value in a database. then you just put the file in the upload folder.

chrisj

Thanks for all the replies