943,650 Members | Top Members by Rank

Ad:
  • PHP Discussion Thread
  • Marked Solved
  • Views: 2271
  • PHP RSS
You are currently viewing page 1 of this multi-page discussion thread
Mar 17th, 2008
0

File upload help

Expand Post »
Is there anything wrong with this script?

PHP Syntax (Toggle Plain Text)
  1. <?php
  2.  
  3. $username="";
  4. $password="";
  5. $database="";
  6.  
  7. $rom_name = $_POST['rom_name'];
  8. $rom = $_FILES['rom']['name'];
  9.  
  10. function getExtension($str) {
  11. $i = strrpos($str,".");
  12. if (!$i) { return ""; }
  13. $l = strlen($str) - $i;
  14. $ext = substr($str,$i+1,$l);
  15. return $ext;
  16. }
  17.  
  18. if (empty($rom)) {
  19. $result = '<font color=FFFFFF>Please choose a ROM to upload</font>';
  20. $error++;
  21. }
  22. else {
  23. $filename = stripslashes($rom);
  24. $extension = getextension($filename);
  25. $extension = strtolower($extension);
  26. if (($extension !== "zip") && ($extension !== "ZIP") && ($extension !== "rar") && ($extension !== "ZIP")) {
  27. $result = '<font color=FFFFFF>Unknown file extension, please try again</font>';
  28. $error++;
  29. }
  30. else {
  31. $tmpFile = $_FILES['rom']['tmp_name'];
  32. $sizekb = filesize($tmpFile);
  33. if ($sizekb > 5000000) {
  34. $result = '<font color=FFFFFF>The file has exceeded the size limit, please try again</font>';
  35. $error++;
  36. }
  37. else {
  38. $romName = '/gba_roms/files/' . time() . '.' . $extension;
  39. $copy = copy($tmpFile, $romName);
  40. $letter = ucfirst($rom_name);
  41. if (!$copy) {
  42. $result = '<font color=FFFFFF>File upload unsuccessful, please try again</font>';
  43. $error++;
  44. }
  45. }
  46. }
  47. }
  48. if ($error > 0) {
  49. echo $result;
  50. }
  51. else {
  52. $con = mysql_connect('localhost',$username,$password);
  53. @mysql_select_db($database) or die( "Unable to select database");
  54. $sql = "INSERT INTO `gba_roms` VALUES ('','$rom_name','$romName','$letter')";
  55. $query = mysql_query($sql) or die('Error: ' . mysql_error());
  56. }
  57.  
  58. mysql_close();
  59.  
  60. ?>
Similar Threads
Reputation Points: 10
Solved Threads: 0
Junior Poster in Training
Scottmandoo is offline Offline
61 posts
since Feb 2008
Mar 17th, 2008
0

Re: File upload help

Hi Scottmandoo,
best if you place this at the top and run it:
php Syntax (Toggle Plain Text)
  1. ini_set("display_errors", true);
  2. error_reporting(255);
Then you could post the error messages and I'll explain what they mean.

Also, could you please edit your post and add "=php" into the tag code (code=php)? It will tell this forum to use PHP language syntax highlighting and the source code will be much easier to read.

As a bonus, here's a simpler getExtension() function:
php Syntax (Toggle Plain Text)
  1. $extension = strtolower(substr(strrchr($file_name, "."), 1));
Reputation Points: 27
Solved Threads: 16
Junior Poster
petr.pavel is offline Offline
116 posts
since Mar 2008
Mar 17th, 2008
0

Re: File upload help

Heres what I got...

Notice: Undefined index: rom_name in /www/10gbfreehost.com/b/l/a/blastburners/htdocs/gba_roms/insert-gba.php on line 490

Notice: Undefined index: rom in /www/10gbfreehost.com/b/l/a/blastburners/htdocs/gba_roms/insert-gba.php on line 491

Notice: Undefined variable: error in /www/10gbfreehost.com/b/l/a/blastburners/htdocs/gba_roms/insert-gba.php on line 503
Please choose a ROM to upload
Warning: mysql_close(): no MySQL-Link resource supplied in /www/10gbfreehost.com/b/l/a/blastburners/htdocs/gba_roms/insert-gba.php on line 540

Wheres the edit button? Anyway heres my code again using the php code thing

php Syntax (Toggle Plain Text)
  1. <?php
  2.  
  3. $username="";
  4. $password="";
  5. $database="";
  6.  
  7. $rom_name = $_POST['rom_name'];
  8. $rom = $_FILES['rom']['name'];
  9.  
  10. function getExtension($str) {
  11. $i = strrpos($str,".");
  12. if (!$i) { return ""; }
  13. $l = strlen($str) - $i;
  14. $ext = substr($str,$i+1,$l);
  15. return $ext;
  16. }
  17.  
  18. if (empty($rom)) {
  19. $result = '<font color=FFFFFF>Please choose a ROM to upload</font>';
  20. $error++;
  21. }
  22. else {
  23. $filename = stripslashes($rom);
  24. $extension = getextension($filename);
  25. $extension = strtolower($extension);
  26. if (($extension !== "zip") && ($extension !== "ZIP") && ($extension !== "rar") && ($extension !== "ZIP")) {
  27. $result = '<font color=FFFFFF>Unknown file extension, please try again</font>';
  28. $error++;
  29. }
  30. else {
  31. $tmpFile = $_FILES['rom']['tmp_name'];
  32. $sizekb = filesize($tmpFile);
  33. if ($sizekb > 5000000) {
  34. $result = '<font color=FFFFFF>The file has exceeded the size limit, please try again</font>';
  35. $error++;
  36. }
  37. else {
  38. $romName = '/gba_roms/files/' . time() . '.' . $extension;
  39. $copy = copy($tmpFile, $romName);
  40. $letter = ucfirst($rom_name);
  41. if (!$copy) {
  42. $result = '<font color=FFFFFF>File upload unsuccessful, please try again</font>';
  43. $error++;
  44. }
  45. }
  46. }
  47. }
  48. if ($error > 0) {
  49. echo $result;
  50. }
  51. else {
  52. $con = mysql_connect('localhost',$username,$password);
  53. @mysql_select_db($database) or die( "Unable to select database");
  54. $sql = "INSERT INTO `gba_roms` VALUES ('','$rom_name','$romName','$letter')";
  55. $query = mysql_query($sql) or die('Error: ' . mysql_error());
  56. }
  57.  
  58. mysql_close();
  59.  
  60. ?><?php
  61.  
  62. $username="";
  63. $password="";
  64. $database="";
  65.  
  66. $rom_name = $_POST['rom_name'];
  67. $rom = $_FILES['rom']['name'];
  68.  
  69. function getExtension($str) {
  70. $i = strrpos($str,".");
  71. if (!$i) { return ""; }
  72. $l = strlen($str) - $i;
  73. $ext = substr($str,$i+1,$l);
  74. return $ext;
  75. }
  76.  
  77. if (empty($rom)) {
  78. $result = '<font color=FFFFFF>Please choose a ROM to upload</font>';
  79. $error++;
  80. }
  81. else {
  82. $filename = stripslashes($rom);
  83. $extension = getextension($filename);
  84. $extension = strtolower($extension);
  85. if (($extension !== "zip") && ($extension !== "ZIP") && ($extension !== "rar") && ($extension !== "ZIP")) {
  86. $result = '<font color=FFFFFF>Unknown file extension, please try again</font>';
  87. $error++;
  88. }
  89. else {
  90. $tmpFile = $_FILES['rom']['tmp_name'];
  91. $sizekb = filesize($tmpFile);
  92. if ($sizekb > 5000000) {
  93. $result = '<font color=FFFFFF>The file has exceeded the size limit, please try again</font>';
  94. $error++;
  95. }
  96. else {
  97. $romName = '/gba_roms/files/' . time() . '.' . $extension;
  98. $copy = copy($tmpFile, $romName);
  99. $letter = ucfirst($rom_name);
  100. if (!$copy) {
  101. $result = '<font color=FFFFFF>File upload unsuccessful, please try again</font>';
  102. $error++;
  103. }
  104. }
  105. }
  106. }
  107. if ($error > 0) {
  108. echo $result;
  109. }
  110. else {
  111. $con = mysql_connect('localhost',$username,$password);
  112. @mysql_select_db($database) or die( "Unable to select database");
  113. $sql = "INSERT INTO `gba_roms` VALUES ('','$rom_name','$romName','$letter')";
  114. $query = mysql_query($sql) or die('Error: ' . mysql_error());
  115. }
  116.  
  117. mysql_close();
  118.  
  119. ?>

EDIT: found the edit button, but for some reason it doesnt show up on my first post
Last edited by Scottmandoo; Mar 17th, 2008 at 8:51 am.
Reputation Points: 10
Solved Threads: 0
Junior Poster in Training
Scottmandoo is offline Offline
61 posts
since Feb 2008
Mar 17th, 2008
0

Re: File upload help

Thanks for the syntax highlighting it's much better.
The errors you are getting aren't deadly. So why do you think there's something wrong with the script?

Looking at the script I have a few suggestions:
* don't use copy() for moving uploaded files as most hostings will not like it.
First test if the upload was successful:
php Syntax (Toggle Plain Text)
  1. if (is_uploaded_file($_FILES['rom']['tmp_name'])) {
  2. }
and then move it with
php Syntax (Toggle Plain Text)
  1. move_uploaded_file ($_FILES['rom']['tmp_name'], $romName);

* $romName most likely doesn't contain a valid path
It should be
/www/10gbfreehost.com/b/l/a/blastburners/htdocs/gba_roms/files/....
not just
/gba_roms/files/...

Best if you use $_SERVER["DOCUMENT_ROOT"].'/gba_roms/files/'...

* you should move mysql_close() two lines higher just after mysql_query()
Now it attempts to close a non-existing connection if $error > 0.

* you shouldn't insert values taken from $_POST/$_GET directly into database without running it through mysql_real_escape_string(). A hacker could use this security hole to wipe out your database or replace its content with malicious data.
Reputation Points: 27
Solved Threads: 16
Junior Poster
petr.pavel is offline Offline
116 posts
since Mar 2008
Mar 19th, 2008
0

Re: File upload help

Thanks it works now, just one more problem though, when I upload files over 2mb it doesnt work. I get the first error "Please choose a rom to upload!"

php Syntax (Toggle Plain Text)
  1. <?php
  2.  
  3. $username="my_username";
  4. $password="my_password";
  5. $database="my_database";
  6.  
  7. $tut_name = $_POST['tut_name'];
  8. $letter = ucfirst($_POST['tut_name']);
  9. $tut_image = $_FILES['tut_image']['name'];
  10.  
  11. function getExtension($str) {
  12. $i = strrpos($str,".");
  13. if (!$i) { return ""; }
  14. $l = strlen($str) - $i;
  15. $ext = substr($str,$i+1,$l);
  16. return $ext;
  17. }
  18.  
  19. if (empty($tut_image)) {
  20. $result = '<font color=FFFFFF>Please choose a rom to upload!</font>';
  21. $error++;
  22. }
  23. else {
  24. $filename = stripslashes($tut_image);
  25. $extension = getextension($filename);
  26. $extension = strtolower($extension);
  27. if (($extension !== "zip") && ($extension !== "rar")) {
  28. $result = '<font color=FFFFFF>Unknown file extension, please try again</font>';
  29. $error++;
  30. }
  31. else {
  32. $tmpFile = $_FILES['tut_image']['tmp_name'];
  33. $sizekb = filesize($tmpFile);
  34. if ($sizekb > 8000000) {
  35. $result = '<font color=FFFFFF>The file has exceeded the size limit, please try again</font>';
  36. $error++;
  37. }
  38. else {
  39. $imageName = '../files/gba-roms/' . time() . '.' . $extension;
  40. $copy = copy($tmpFile, $imageName);
  41. if (!$copy) {
  42. $result = '<font color=FFFFFF>File upload unsuccessful, please try again</font>';
  43. $error++;
  44. }
  45. }
  46. }
  47. }
  48. if ($error > 0) {
  49. echo $result;
  50. }
  51. else {
  52. $con = mysql_connect('localhost',$username,$password);
  53. @mysql_select_db($database) or die( "Unable to select database");
  54. $sql = "INSERT INTO `gba_roms` VALUES ('','$tut_name','$imageName','$letter')";
  55. $query = mysql_query($sql) or die('Error: ' . mysql_error());
  56.  
  57. mysql_close();
  58. }
  59.  
  60.  
  61.  
  62. ?>

Also you may knowtice in this script it doesnt contain most of your advice, this is because when I tried it my page just loaded blank, unless I did it wrong let me know.

Also note I am able to upload up to 8mb on my host and have successfully done so with an FTP client.
Last edited by peter_budo; Mar 24th, 2008 at 7:18 am. Reason: User reguest
Reputation Points: 10
Solved Threads: 0
Junior Poster in Training
Scottmandoo is offline Offline
61 posts
since Feb 2008
Mar 19th, 2008
0

Re: File upload help

Hi there,
because you posted your database login info here you will have to change it. Otherwise the first hacker who happens to read this (e.g. using an automated search script) will either erase your database or fill it with malicious data.

Now back to bug hunting: I suggest you keep
php Syntax (Toggle Plain Text)
  1. ini_set("display_errors", true);
  2. error_reporting(255);
at the top until you solve all problems.
This should show you what is the reason for getting a blank screen.

The 2MB is default file upload PHP limit, that's why it didn't affect you when you used FTP.
It's very likely that you aren't allowed to change this settings unless you have a very benevolent hosting provider. If you are though, then you have these options:
  • If you run the server yourself then locate php.ini and edit upload_max_filesize, post_max_filesize, max_execution_time, max_input_time and memory_limit. I'll explain them later.
  • Or if your server runs web server Apache and .htaccess parsing is on then put file .htaccess into the same directory as your script. Its name really starts with a dot. Some FTP clients don't show unix hidden files by default - and hidden files = dot files. So don't be surprised if you upload the file and don't see it then in the listing. Check your FTP client settings. This should be in it (use your own values):
    PHP Syntax (Toggle Plain Text)
    1. php_value upload_max_filesize 100M
    2. php_value post_max_size 100M
    3. php_value max_execution_time 1800
    4. php_value max_input_time 1800
    5. php_value memory_limit 100M
    Note: I think you have to use Unix line endings if your server is on *nix although I'm not sure.
  • or you have to use ini_set() functions to set the values in PHP
    e.g. ini_set("upload_max_filesize" , "10M");

Now why so many settings. There's a limit for file size (upload_max_filesize) but there's also a limit for how much you can send through POST (post_max_size). The only meaningful method of sending files is using POST but files aren't all you can send with POST. That's why there are two limits.
Then max_input_time limits how long the script waits for input (until your files are transmitted). Calculate it using your Internet connection speed and max file size.
Input time (I think) counts into execution time so you have to set max_execution_time as well.
Again, I'm not sure but I think that uploaded files count into your memory limit (memory_limit). Maybe not if you don't read them into memory (e.g. file_get_contents()) but it's up to you to find out.
Last edited by petr.pavel; Mar 19th, 2008 at 8:06 am. Reason: icode syntax
Reputation Points: 27
Solved Threads: 16
Junior Poster
petr.pavel is offline Offline
116 posts
since Mar 2008
Mar 24th, 2008
0

Re: File upload help

Sorry I havnt replied for a while, I've been on holidays for the weekend and just gut back.

My web server doesnt allow .htaccess files because...
Quote ...
htaccess eats a lot of server resources and this is why it is not allowed on our free plan.
So I have asked my web server admin if theres any chance of changing those settings in the php.ini with no reply as of yet. Though the web host on very new and is still constantly changing settings to help out its members so theres a high chance the settings will get changed.

What I want to know is, if the host asks what I want all these settings (upload_max_filesize, post_max_filesize, max_execution_time, max_input_time and memory_limit) changed to what should I say? Remember the max file size my host accepts for free accounts is currently 8mb.
Last edited by Scottmandoo; Mar 24th, 2008 at 6:08 am.
Reputation Points: 10
Solved Threads: 0
Junior Poster in Training
Scottmandoo is offline Offline
61 posts
since Feb 2008
Mar 25th, 2008
0

Re: File upload help

Hi Scottmandoo,
I'm a bit confused. Are you saying that the total file size of all files in your hosting must not be higher than 8 MB? Boy that's not much :-) Try http://pipni.cz/ - you get 1.5 GB there for free (it's a Czech server but you can switch the language to English).

If your limit for all files really is 8MB then you have to modify your script to check what the file size of already uploaded files is.

Let's assume that you want to limit max size of the file being uploaded to 7MB:
upload_max_filesize 7M
post_max_size 7M
(If you are going to read the file into memory then set memory_limit too.)

Now let me show you how you are going to calculate the other two:
We have to decide what is the slowest Internet connection that you will support. Let's make it 256 kpbs (uplink), for instance.
Here's the formula:
y = (256/8) speed in kilobytes per second
x = (7*1024 / y) how many seconds it would take to upload a 7MB file
Result is: 224 seconds
This would be true if your customer is able to use full this theoretical speed throughout the whole upload time which is impossible. So I suggest that you multiply it by 1.5 to provide some cushion.

Your value would be then 336 seconds:
max_input_time 336
You don't have to touch max_execution_time because your script doesn't really do anything, it just moves the file, it doesn't process it. (I'd like to correct my earlier statement here - input time doesn't count into execution time)
Reputation Points: 27
Solved Threads: 16
Junior Poster
petr.pavel is offline Offline
116 posts
since Mar 2008
Mar 26th, 2008
0

Re: File upload help

Click to Expand / Collapse  Quote originally posted by petr.pavel ...
Are you saying that the total file size of all files in your hosting must not be higher than 8 MB? Boy that's not much :-) Try http://pipni.cz/
Yeah I know it sucks, but thats the only downfall of my host along with no .htaccess support for free accounts, it provides 10gb of storage, 20gb monthly bandwidth, no ads and heaps more. http://10gbfreehost.com

Also so what your saying is I only need the following editted?
upload_max_filesize 8M
post_max_size 8M
max_input_time 384
Reputation Points: 10
Solved Threads: 0
Junior Poster in Training
Scottmandoo is offline Offline
61 posts
since Feb 2008
Mar 26th, 2008
0

Re: File upload help

If you are going to do only what you do now: move the file from temporary location to permanent location then yes, set only these three ini attributes.

If you are going to process the ROM files though, (extract something from it or rearrange it) then you will also have to set memory_limit and max_execution_time.
Reputation Points: 27
Solved Threads: 16
Junior Poster
petr.pavel is offline Offline
116 posts
since Mar 2008

This thread is solved

Either the thread starter or a moderator has marked this thread as solved. You can most likely trust the responses and answers given. There is most likely no reason for any further responses to be posted here. If you have a related question, please start a new thread in this forum instead.

This thread is more than three months old

No one has posted to this discussion for at least three months. Please let old threads die and do not reply to them unless you feel you have something new and valuable to contribute that absolutely must be added to make the discussion complete. Otherwise, please start a new thread in this forum instead.
Message:
Previous Thread in PHP Forum Timeline: print function.
Next Thread in PHP Forum Timeline: send data from while loop to mysql database





About Us | Contact Us | Advertise | Acceptable Use Policy
Forum Index | Build Custom RSS Feed


Follow us on Twitter


© 2011 DaniWeb® LLC