file upload advice please

[deuce868]

I am looking for good examples for file uploading. I have a hosted site that I need to do two things. On one portion I need to upload images and store the locations in MySQL. On the second I need to upload powerpoint presentations and store the locations in MySQL. I need to be able to rename the files.

I have found several kinds of ideas...but I am curious what you all have found to be the safest and fool proof (because I do not have full permissions on the server) methods. Should I try copy() or something else?

Thanks for the help and advice.

[lveale]

I have constants denoted C_ in a different file. Their values are:

define("C_UL_IMG_MAXSIZE",        389295); /* Maximum File Upload Size, in BYTES!!!! */
define("C_UL_FILEMODE",            0777); /* File permissions, chmod style */
define("C_UL_OW",                 FALSE); /* set to TRUE if you want to overwrite files */ 
define("C_IMG_DIR",             "uploads/"); /* image directory, URL */
define("C_UL_DIR",                 "D:/Inetpub/wwwroot/site/uploads/");




/**
class FileUPload handles file uploads
*/

class FileUpload
{

    var $maxupload_size; //constant
    var $overwrite; //constant
    var $extAllowed =    array(".jpg", ".gif", ".bmp");
    var $uploadErrors = array();
   
    /**
      * Constructor
      */ 
    function FileUpload($fileName, $fileSize, $fileType, $fileTempName)
    {          
        $this->fName         = $fileName;
        $this->fSize        = $fileSize;
        $this->fType        = $fileType;
        $this->fTempName    = $fileTempName;    
   
                
     }
    
    function saveFile($newFileName="")
    {            
        if ($this->fSize     < C_UL_IMG_MAXSIZE && $this->fSize     >0)
        {
                        
            $this->isPosted = true;
            $tempName = $this->fTempName;
      
            // if a new file name, save as that, otherwise use uploaded one
            if($newFileName)
            {
                  $file = $newFileName;
              }
              else
            {
                 $file = $this->fName;
              }      
            $all = C_UL_DIR.$file;

            // Copy to directory
            if (file_exists($all))//file exists
              { 
                if(C_UL_OW) //if overwrite is on, delete older version
                {                         
                      if(!@unlink($all)) array_push($this->uploadErrors,"Can't delete file $all");
          
                      //echo count($this->uploadErrors);
                                        
                      if(!@copy($tempName,$all)) 
                    {         
                           array_push($this->uploadErrors, "Can't copy file $all");
                    }
                                        
                      @chmod($all,C_UL_FILEMODE)    || die();
          
                      return TRUE;
                }
                else
                {
                      $file = $this->changeFileName($file);
          
                      $all = C_UL_DIR.$file;
          
                      copy($tempName, $all);
          
                      chmod($all, C_UL_FILEMODE);
          
                      return TRUE;
                }
            }
              else
              {          
                @copy($tempName,$all)   || die();
                @chmod($all,C_UL_FILEMODE)      || die();
                return TRUE;
            }
            
        }
        elseif($this->fSize     > C_UL_IMG_MAXSIZE)
        {
            return FALSE;
        }
        elseif($this->fSize    == 0)
        {
            array_push($this->uploadErrors, "You must include a file!");
            return FALSE;
        }
    }//end save
    
    function getFilename()
    {
        return $this->fName;
    }
    
    function getFileType($field)
    {
        return $this->fType;
    }
    
    function getFileSize()
    {
        return $this->fSize;
    }
 
    function getExtension($file)
    {
        return strrchr($file, "." );
     } //end func getExtension

     function checkExtension($file)
    {
         return(in_array($this->getExtension($file),$this->extAllowed));
     }
 
    function changeFileName($file, $newName="")
    {
          $fileExt = $this->getExtension($file);
    
        //echo "file:".$file;
    
        if(!$newName)
        {
            $newFilePreExt = substr($file, 0, strpos($file, "."));
            $newName = $newFilePreExt . date("Ymd_His") . $fileExt;
        }
        else
        {
            $newFilePreExt = substr($newName, 0, strpos($newName,".")); //if there is an extension
              $newName = $newFilePreExt.$fileExt;     
        }      
        $this->fName = $newName;
        return $newName;
      }
            
      function test()
    {
          echo "<h2>Constructor Params</h2>";
        echo $this->fName."<br />";
        echo $this->fSize."<br />";
        echo $this->fType."<br />";
        echo $this->fTempName."<br />";
        echo "<hr />";
        echo "<h2>Constants</h2>";
        echo C_UL_IMG_MAXSIZE."<br />";
        echo C_UL_OW."<br />";
        echo C_UL_DIR."<br />"; 
        echo "<hr/>";
      } 

    function getErrorCount()
      {
        return count($this->uploadErrors);
      }
  
      function getErrors()
      {
          for($i=0;$i<count($this->uploadErrors);$i++)
            echo $this->uploadErrors[$i]."<br />";
        //    return $this->uploadErrors;
      }
}//end class 

I include the above file in another script and then do this:

// get uploaded image details
/* Note: C_PAGE_IMG is a constant that value whose value will also be in the form field I use to upload the file */

$imgName                 =     $HTTP_POST_FILES[C_PAGE_IMG]['name'];
$imgSize                 =     $HTTP_POST_FILES[C_PAGE_IMG]['size'];
$imgType                 =     $HTTP_POST_FILES[C_PAGE_IMG]['type'];
$imgTempName             =     $HTTP_POST_FILES[C_PAGE_IMG]['tmp_name'];

//then use the class

$img = new FileUpLoad($imgName, $imgSize, $imgType, $imgTempName);
$img->saveFile();
$imgFile = C_IMG_DIR. $img->getFilename();

/* we now have:
1) the URL to the image which we can store in a DB ($imgFile)
2) the image file on the server
*/ 

** Things to watch out for:

- Form tag make sure you have:
enctype="multipart/form-data"

- write permissions (need to CHMOD) to the directory you want to save the images into

[deuce868]

thanks!

I'll take a look through it. I have not yet made it to php classes so this will be really cool to go through.

[lveale]

no worries. Once you use classes you will never go back! But it does take a little time to crack it. I use that script in a CMS and it works brilliantly. I got the original from Hotscripts.com or zend.com ca't remember which and made a couple of changes.

[makeda]

Wow! Very nice. I've been wanting to write an FTP class...it useful to see how you went about it.

[lveale]

makeda, It's not really an FTP class, the file is uploaded with HTTP through your browser. It is another way to get files on to your server other than via FTP.

[deuce868]

I am just now getting to take a look at this and I am trying to figure out a part of the script.

FUNCTION saveFile($newFileName="") 

But you call the funtion without any parameters. I have not seen this before and I am trying to figure out how it works.

If you pass a value does it get set? Would i need to edit this to save the file with a different name

Thanks

[lveale]

You would call it like this:

/* Note params here are from where you pick up the form submittal */
$fp = new FileUpload($fileName, $fileSize, $fileType, $fileTempName)
$fp->saveFile(); /* saves it with original name from where you uploaded it */
/* OR */
$fp->saveFile("newname"); 

[deuce868]

ok, that was what I wondered. If you passed a value to saveFile if it would use it instead of "". I just have never seen a function with a variable setto "" in it like that and was unsure how it worked.

Thanks for the info