How to add file size limits to Upload Form

chrisj

How do I add a file size limit to my upload form code (below)?

Is this correct?

if (  $_FILES["file"]["size"] < 100000

Where can I add it to make it functional?
Do I need any additional code to make that line of code functional?
This is a 100kb limit correct?
How/where can I add in an error message, - if the file size is over the limit?

$allowedExts = array("gif", "jpeg", "jpg", "pdf", "doc", "docx", "txt", "rtf", "png");
$temp = explode(".", $_FILES["file"]["name"]);
$extension = strtolower( end($temp) );
if (!in_array($extension,$allowedExts))
{
echo ("Error - Invalid File Name");
}
$length = 20;
$randomString = (time());
$thumbnail = $_SESSION['user_id'] . '-' . $randomString . "." . $extension;
move_uploaded_file($_FILES["file"]["tmp_name"], "upload/" . $thumbnail);
$sql = "INSERT INTO videos ( filename ) VALUES( '$thumbnail' )";
mysql_query($sql);
$file_location = '<a href="http://www.......com/upload/' . $thumbnail . '">' . $thumbnail .     '</a>';

Thanks. I look forward to any help.

sid

$allowedExts = array("gif", "jpeg", "jpg", "pdf", "doc", "docx", "txt", "rtf", "png");
$temp = explode(".", $_FILES["file"]["name"]);
$extension = strtolower( end($temp) );

if (!in_array($extension,$allowedExts))
{
  echo ("Error - Invalid File Name");
}
else if ($_FILES["file"]["size"] >= 100000) 
{
  echo ("Error - File is too big");
}
else 
{
  $length = 20;
  $randomString = (time());
  $thumbnail = $_SESSION['user_id'] . '-' . $randomString . "." . $extension;
  move_uploaded_file($_FILES["file"]["tmp_name"], "upload/" . $thumbnail);

  $sql = "INSERT INTO videos ( filename ) VALUES( '$thumbnail' )";
  mysql_query($sql);

  $file_location = '<a href="http://www.......com/upload/' . $thumbnail . '">' . $thumbnail .     '</a>';
}

You output an error, but still continue to process the uploaded file. Seems like that isn't what you intended.
$length doesn't seem to be used anywhere (in this code sample anyways)
The above example verifies the extension, then the size and eventually goes on with processing the file, if both checks passed (i.e. the error conditions returned false).

NogDog

Note that you can add size limitations in the HTML itself, allowing the user's browser to prevent them from having to wait for the whole file to upload before you tell them it's too big (though of course you can not depend on that as your only line of defense). There is also a max file size limitation you can set in your php.ini or .htaccess PHP settings to limit upload file size and maximum post size.

chrisj

Thanks for the replies