>> PHP: File Uploads

Uploading Files to Server Pre-requisite To Upload a file to the server using the <input type=“file”> tag, the following should be taken into consideration Always use the POST method to submit form data Add the attribute “enctype” to the form tag. Without this attribute, the file is not uploaded. <form method=“POST” action=“add.php” enctype=“multipart/form-date”> Web-Based Systems - Misbhauddin

Inserting / Uploading Items to DB <form method=“GET” action=“add.php>” add.php?-------&image=/img/a.png&…. add.php if(input type == file) { Create associative array $_FILES $_FILES = array(); $_FILES[‘image’] = array(‘name’ => ‘/img/a.png’, ‘tmp_name’ => ‘/abc/as/acd/a.png’, ‘size’ => xxxxx, ‘type’ => ‘image/png’; } <input type=“file” name=“image>” $_FILES image /img/a/png /abc/as/acd/a.png xxxxx image/png ------------- name tmp_name size type error Web-Based Systems - Misbhauddin

Copy File to Local Folder & File Upload Methods File Upload Methods Copy File to Local Folder & Store the path in the DB Store the file in the DB BLOB In order to upload files to the server, the form should declare another attribute enctype="multipart/form-data" Web-Based Systems - Misbhauddin

Step 1: Uploads Folder Initialization Step 1: Initialize variable with the name of the folder you plan to store the file on the server $target_path = “img/stuff/"; Processing Steps Path you want to store the file on your server Web-Based Systems - Misbhauddin

Step 2: Construct the Destination Path Step 2: Strip the source directory and extract the filename (Use the basename function in PHP) $target_path = $target_path . basename( $_FILES[‘image']['name']); Concatenate the filename to the path basename() Return the trailing part of a path basename("/etc/sudoers.d“) Processing Steps sudoers.d Web-Based Systems - Misbhauddin

Step 3: Move File to Permanent Location Processing Steps Step 3: Move the file from the temporary directory to your server directory source $out = move_uploaded_file($_FILES[‘image']['tmp_name'], $target_path); Move file from source to destination path true File transferred successfully false There was an error in the transfer process Web-Based Systems - Misbhauddin

Factor 1: Check File Size Decide to Keep or Remove the File Factor 1: File is too large if($_FILES[‘image’][‘size’] > xxxxx) In bytes Note: Always let the user know the max. file size you accept Suggestion: Create a hidden input filed with name MAX_FILE_SIZE and value equal to the maximum size <input type=“hidden” name=“MAX_FILE_SIZE” value=“512000”> Why: If we decide to change it in future, we can just change this value from the HTML file Web-Based Systems - Misbhauddin

Factor 2: Check File Type Decide to Keep or Remove the File Factor 2: File type is right if($_FILES[‘image’][‘type’] == ‘image/png’) Issue: writing a condition for each type when you expect a class of files such as images or document Solution: Checking it yourself $ext = array("gif", "jpeg", "jpg", "png"); Array of all accepted extensions $extension = end(explode(".", $_FILES["file"]["name"])); Extract the extension of the file Get the last element in the array Splits the string into arrays at the given delimiter if(in_array($extension, $ext))) Check the extension Subset function for arrays Web-Based Systems - Misbhauddin

Factor 3 AND 4: Check For Errors Decide to Keep or Remove the File Factor 3: File uploaded successfully if($_FILES[‘image’][‘error’] > 0) Factor 4: File moved successfully if($out = ‘true’) Web-Based Systems - Misbhauddin

Inserting / Uploading Items to DB Alternate Method to Upload Files Step 1: Create a table that has a file column with type set to LONGBLOB CREATE TABLE uploads (……, data LONGBLOB, … ); Reads entire file into a string Step 2: Prepare the file $image = addslashes(file_get_contents($_FILES[‘image’][‘tmp_name’]), filesize($_FILES[‘image’][‘tmp_name’]))); Returns the file size backslashes before characters that need to be quoted Step 3: Create and Run Query $query="INSERT into uploads (……., image, ……) values (…….,'$image',……..)"; $result = mysqli_query($query); Step 4: Check for all previous factors and display appropriate message to the user