Log in

View Full Version : File Upload Help



Rockonmetal
07-15-2007, 11:34 PM
Hey was up guys...
So I am planning on making the next YouTube *called PUREADD!*. Though heres the thing I don't want the video to go on its own webpage. Basicly I am just asking how to validate this in someway. I have a simple upload tag in there which uploads it to a folder named "Uploads". But as most of you can see. Anyone can upload anyfile less than 1Gb. *I have that Hidden Input in there which works.* So I could get a ton of .html, php, even images instead of funny videos.
I do not know how to do this. I tried PHP Freaks and their tutorial did not work. It wouldn't upload. I got this off of Tenzig or something like that. It works. Just I don't know how to validate this.

<html>
<head>
</head>

<body>

<?php
$var = $_POST["text"];
$var2 = $_POST["text2"];
$var3 = $_POST["text3"];
$var4 = $_POST["text4"];
$var5 = $_POST["text5"];
$var6 = $_POST["text6"];
$var7 = $_POST["uploadedfile"];
echo "Please Fill Out The Form Below"
?>

<?php
$filename = 'data.html';
$somecontent = "
<br>
<table class='data'>
<tr><td>Name:</td><td> $var</td>
<tr><td>Email Address:</td><td> $var2</td>
<tr><td>Password:</td><td> $var3</td>
<tr><td>Comfirmed Password:</td><td> $var4</td></tr>
<tr><td>Video Notes:</td><td> $var5</td></tr>
<tr><td>Agree to Terms:</td><td> $var6</td></tr>
<tr><td>File Name:</td><td> $var7</td></tr>
</table>
<br>";

// Let's make sure the file exists and is writable first.
if (is_writable($filename)) {

// In our example we're opening $filename in append mode.
// The file pointer is at the bottom of the file hence
// that's where $somecontent will go when we fwrite() it.
if (!$handle = fopen($filename, 'a')) {
echo "Cannot open file ($filename)";
exit;
}

// Write $somecontent to our opened file.
if (fwrite($handle, $somecontent) === FALSE) {
echo "Cannot write to file ($filename)";
exit;
}

echo "<br>Success, your content to the database. Do not refresh the page or your entry will be deleted.";

fclose($handle);

} else {
echo "The file $filename is not writable";
}
$target_path = "uploads/";

$target_path = $target_path . basename( $_FILES['uploadedfile']['name']);

if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) {
echo "The file ". basename( $_FILES['uploadedfile']['name']).
" has been uploaded";
} else{
echo "There was an error uploading the file.";
}

?>

</body>
</html>
BTW! I can learn pretty easily. Just as long as the code isn't 400 pages or is all on one line *I CANNOT STAND THAT!* I was having one problem also. If two files get uploaded with the same name the one that was uploaded 2nd would overwrite the first... If theres anyway I could make a sorta check if/else statement to rename the file being uploaded.

THANKS SO MUCH!

Twey
07-15-2007, 11:52 PM
*I have that Hidden Input in there which works.*For a given value of "works." It doesn't actually limit what the user can upload, since the user can simply modify its value. Your markup is invalid too.
So I could get a ton of .html, php, even images instead of funny videos.Hmmm, now here's a tricky question. YouTube runs the video through a whole parser in order to convert it to FLV format -- they can weed things out that way. This might be a viable option, but it depends how fast your server is. Other options would depend on what software you have installed. If you have the file utility, for example, you can use that to perform a cursory check.

alexjewell
07-15-2007, 11:55 PM
To make sure they're video files, check to make sure that the extension is something that's, say, in_array() in an array of supported video formats.

Now, for the seeing if there's already a file with that name, use file_exists...



if(!file_exists($filename){
// upload file
}

else{
// display message asking to give the file another name or just add a 1 on the end or something
}

Rockonmetal
07-16-2007, 08:22 PM
Uh so how would i put this in there??????

Rockonmetal
07-16-2007, 09:06 PM
Markup for what??? And how could get it in to that code Alex?

alexjewell
07-17-2007, 01:43 PM
Well, as the comments in the code say, if there isn't already a file that exists with the same name, (!file_exists($_FILES['uploadedfile']['name'])), upload it. If there is, else, do something else like add something on the end or display a message telling them there's already a file with that name and they should rename the file before uploading. Maybe giving an option to upload anyway, if the file they're trying to upload is just an updated version of the one already there. Something like that.

Rockonmetal
07-17-2007, 04:29 PM
So how would this look in the end? Sorry I'm just starting out with php, only got a few commands like echo and var.

Rockonmetal
07-19-2007, 07:42 PM
All i just need is like the code for this and I'll be able to see how it works and be able to modify it and make new code, cuz thats how i sorta roll. thanks