Uploading Files with PHP
With the release of PHP 4.1.0 came an easier and more secure method of uploading files. In this tutorial, we’ll be looking at the superglobal $_FILES, which allows us to create a basic PHP uploader in only a few lines of code. Because it is a superglobal, it is available in all scopes throughout the script.
Our first step in coding an upload script is creating the HTML form. This form will allow a user to browse for a file and then upload it to a directory. This is the code we will be using:
PHP Code:
<form action="index.php" method="post" enctype="multipart/form-data">
<p><label for="file"><strong>File to Upload:</strong></label>
<input type="file" name="file" id="file" /></p>
<input type="submit" name="submit" value="Submit" /></p>
</form>
I’ll assume you have basic knowledge of HTML, so the above code should be easy to understand. Moving on to the PHP, we first need to check the form has been submitted. This is done like so:
PHP Code:
if (!isset($_POST['submit'])) {
//display the form
else {
// otherwise, process the data
}
Now that we know the form has been submitted, we can process the data. Luckily for us, PHP does all the work. $_FILES stores the submitted data in an array which we can access like so (“file” being the name of our form input and “name” being the file name):
PHP Code:
$_FILES["file"]["name"]
Firstly, to check if there were any errors, we can use an if statement and then use die() to output an error message and stop the execution of the script.
PHP Code:
if ($_FILES["file"]["error"] > 0) {
die("There was a problem uploading your file!");
}
Next, we need to check the type of the file. There are several ways to do this. We could use substr() to get the extension of the file or we could check the mime type of the file. We’re going to check the mime type because it’s safer and we don’t want any script kiddies uploading any malicious files. To get the mime type of a file, we use:
PHP Code:
$_FILES["file"]["type"]
Then, we can make an array of allowed mime types and compare them to the uploaded file. In this tutorial, we will be checking to see if the file is an image.
PHP Code:
$types = array("image/gif", "image/jpeg", "image/pjpeg", "image/png");
We can use PHP’s function in_array() to check if the file type matches any of the types in the array and then use an if statement to display an error message. We also need to make sure the file doesn’t already exist by using the file_exists() function. File_exists() checks a directory (in this case, upload/) and returns true if the file exists.
PHP Code:
if (in_array($_FILES["file"]["type"], $types, true)
&& !file_exists("upload/" . $_FILES["file"]["name"])) {
// continue with the script
}
else {
die("File type is not allowed, or the file already exists");
}
Before uploading the file, we need to check the file size. This is simply done by using the following code (the size is in bytes):
PHP Code:
if($_FILES["file"]["size"] <= 120000) {
// continue with the script
}
else {
die("File is too big!");
}
Now we can upload the file using move_uploaded_file(). Before the file is uploaded to the directory it is given a temporary name (“tmp_name”). Upload/ is just the directory we want to upload to.
PHP Code:
move_uploaded_file ($_FILES["file"]["tmp_name"], "upload/" . $_FILES["file"]["name"]);
Now we will put all the code together and display a message saying the file has been uploaded. Lastly, I used require() to load the HTML form.
PHP Code:
<?php
if (!isset($_POST['submit'])) {
require('form.php');
}
else {
$types = array("image/gif", "image/jpeg", "image/pjpeg", "image/png");
if ($_FILES["file"]["error"] > 0) {
die("There was a problem uploading your file!");
}
else {
if (in_array($_FILES["file"]["type"], $types, true)
&& !file_exists("upload/" . $_FILES["file"]["name"])) {
if($_FILES["file"]["size"] <= 120000) {
if (move_uploaded_file ($_FILES["file"]["tmp_name"], "upload/" . $_FILES["file"]["name"])) {
echo "Your file was successfully uploaded!";
}
else {
die("The file could not be uploaded!");
}
}
else {
die("File is too big!");
}
}
else {
die("File type is not allowed, or the file already exists!");
}
}
}
?>
There you have it, a basic PHP file uploader. To get the script to work, you need to create a directory called upload and CHMOD it to 777. :)
Join the friendly bunch on IRC...
Uploading Files with PHP
Linear Mode
