PHP File Upload Script

With PHP, it is possible to upload files to the server. A PHP script can be used with a HTML form to allow users to upload files to the server. Initially files are uploaded into a temporary directory and then relocated to a target destination by a PHP script.

Information in the phpinfo.php page describes the temporary directory that is used for file uploads as upload_tmp_dir and the maximum permitted size of files that can be uploaded is stated as upload_max_filesize. These parameters are set into PHP configuration file php.ini

The process of uploading a file follows these steps

  • The user opens the page containing a HTML form featuring a text files, a browse button and a submit button.

  • The user clicks the browse button and selects a file to upload from the local PC.

  • The full path to the selected file appears in the text filed then the user clicks the submit button.

  • The selected file is sent to the temporary directory on the server.

  • The PHP script that was specified as the form handler in the form's action attribute checks that the file has arrived and then copies the file into an intended directory.

  • The PHP script confirms the success to the user.

As usual when writing files it is necessary for both temporary and final locations to have permissions set that enable file writing. If either is set to be read-only then process will fail.

An uploaded file could be a text file or image file or any document.

 

Create an Upload-File Form

To allow users to upload files from a form can be very useful.

Look at the following HTML form for uploading files:

<html>
<body>

<form action="upload_file.php" method="post"
enctype="multipart/form-data">
<label for="file">Filename:</label>
<input type="file" name="file" id="file"><br>
<input type="submit" name="submit" value="Submit">
</form>

</body>
</html>

This will display following result:


NOTE: This is just dummy form and would not work.

Notice the following about the HTML form above:

  • The enctype attribute of the <form> tag specifies which content-type to use when submitting the form. "multipart/form-data" is used when a form requires binary data, like the contents of a file, to be uploaded
  • The type="file" attribute of the <input> tag specifies that the input should be processed as a file. For example, when viewed in a browser, there will be a browse-button next to the input field

Note: Allowing users to upload files is a big security risk. Only permit trusted users to perform file uploads.

 

Create an upload script

The "upload_file.php" file contains the code for uploading a file:

<?php
if ($_FILES[“file”][“error”] > 0)
  {
  echo "Error: " . $_FILES[“file”][“error”] . "<br>";
  }
else
  {
  echo "Upload: " . $_FILES[“file”][“name”] . "<br>";
  echo "Type: " . $_FILES[“file”][“type”] . "<br>";
  echo "Size: " . ($_FILES[“file”][“size”] / 1024) . " kB<br>";
  echo "Stored in: " . $_FILES[“file”][“tmp_name”];
  }
?>

By using the global PHP $_FILES array you can upload files from a client computer to the remote server.

The first parameter is the form's input name and the second index can be either "name", "type", "size", "tmp_name" or "error". Like this:

  • $_FILES[“file”][“name”] – the name of the uploaded file
  • $_FILES[“file”][“type”] – the type of the uploaded file
  • $_FILES[“file”][“size”] – the size in kilobytes of the uploaded file
  • $_FILES[“file”][“tmp_name”] – the name of the temporary copy of the file stored on the server
  • $_FILES[“file”][“error”] – the error code resulting from the file upload

This is a very simple way of uploading files. For security reasons, you should add restrictions on what the user is allowed to upload.

 

Upload Restrictions

In this script we add some restrictions to the file upload. The user may upload .gif, .jpeg, and .png files; and the file size must be under 20 kB:

<?php
$allowedExts = array("gif", "jpeg", "jpg", "png");
$extension = end(explode(".", $_FILES[“file”][“name”]));
if ((($_FILES[“file”][“type”] == "image/gif")
|| ($_FILES[“file”][“type”] == "image/jpeg")
|| ($_FILES[“file”][“type”] == "image/jpg")
|| ($_FILES[“file”][“type”] == "image/pjpeg")
|| ($_FILES[“file”][“type”] == "image/x-png")
|| ($_FILES[“file”][“type”] == "image/png"))
&& ($_FILES[“file”][“size”] < 20000)
&& in_array($extension, $allowedExts))
  {
  if ($_FILES[“file”][“error”] > 0)
    {
    echo "Error: " . $_FILES[“file”][“error”] . "<br>";
    }
  else
    {
    echo "Upload: " . $_FILES[“file”][“name”] . "<br>";
    echo "Type: " . $_FILES[“file”][“type”] . "<br>";
    echo "Size: " . ($_FILES[“file”][“size”] / 1024) . " kB<br>";
    echo "Stored in: " . $_FILES[“file”][“tmp_name”];
    }
  }
else
  {
  echo "Invalid file";
  }
?>

 

Store the Uploaded File

The examples above create a temporary copy of the uploaded files in the PHP temp folder on the server.

The temporary copied files disappears when the script ends. To Saving the uploaded file we need to copy it to a different location:

<?php
$allowedExts = array("gif", "jpeg", "jpg", "png");
$extension = end(explode(".", $_FILES[“file”][“name”]));
if ((($_FILES[“file”][“type”] == "image/gif")
|| ($_FILES[“file”][“type”] == "image/jpeg")
|| ($_FILES[“file”][“type”] == "image/jpg")
|| ($_FILES[“file”][“type”] == "image/pjpeg")
|| ($_FILES[“file”][“type”] == "image/x-png")
|| ($_FILES[“file”][“type”] == "image/png"))
&& ($_FILES[“file”][“size”] < 20000)
&& in_array($extension, $allowedExts))
  {
  if ($_FILES[“file”][“error”] > 0)
    {
    echo "Return Code: " . $_FILES[“file”][“error”] . "<br>";
    }
  else
    {
    echo "Upload: " . $_FILES[“file”][“name”] . "<br>";
    echo "Type: " . $_FILES[“file”][“type”] . "<br>";
    echo "Size: " . ($_FILES[“file”][“size”] / 1024) . " kB<br>";
    echo "Temp file: " . $_FILES[“file”][“tmp_name”] . "<br>";

    if (file_exists("upload/" . $_FILES[“file”][“name”]))
      {
      echo $_FILES[“file”][“name”] . " already exists. ";
      }
    else
      {
      move_uploaded_file($_FILES[“file”][“tmp_name”],
      "upload/" . $_FILES[“file”][“name”]);
      echo "Stored in: " . "upload/" . $_FILES[“file”][“name”];
      }
    }
  }
else
  {
  echo "Invalid file";
  }
?>

The script above checks if the file already exists, if it does not, it copies the file to a folder called "upload".

Both comments and pings are currently closed.

Comments are closed.

Designed for Mytoptutorials.com