PHP File upload validation before the file uploads

[Josh Connerty]

Hello,

I have been working on some scripts for a forthcoming site and I have run across an issue. The issue being that when uploading large files (60Mb + ) will only be validated after they have finished being uploaded to a temporary directory. As you could probably imagine this is quite an issue.

Is there somesort of way I can validate the file before it has finished uploading. If so how is this acheived?

I have searched google and till now have found nothing and it is becoming quite tedious.

Thanks in advance for any help given.

[cwarn23]

Try adding the following field to your html form to prevent uploads larger than 60MB

<input type="hidden" name="MAX_FILE_SIZE" value="60000000" />

Other than that, php has no way of validating the upload since php is server side an not client side. So the only real ways to validate an upload is with javascript, flash and java.

[Josh Connerty]

Thanks for the reply and sorry for the slow come back.

Ok so how does that make sure that the file is not larger than 60MB what scripting is behind this?

Also is there any way of validation the extension before upload?

Thanks again.

[cwarn23]

There is a nice little article about it at http://stackoverflow.com/questions/254184/filter-extensions-in-html-form-upload
And a sample html code to accept files smaller than 60MB with only the extension jpg, jpeg and gif the code would be as follows:

<form enctype="multipart/form-data" action="uploader.php" method="POST">
Upload PNG File:
<input name="Upload Saved Replay" type="file" accept="image/gif, image/jpeg"/><br />
<input type="hidden" name="MAX_FILE_SIZE" value="60000000" />
<input type="submit" value="Upload File" />
</form>

Also note that you need to enter the mime types into the accept= parameter. More info on that can be found at http://www.w3schools.com/TAGS/att_form_accept.asp

[BzzBee]

before uploading apply this php check.

<form enctype="multipart/form-data" action="upload.php" method="POST">
Upload PNG File:
<input name="Upload" type="file" /><br />
<input type="hidden" name="MAX_FILE_SIZE" value="60000000" />
<input type="submit" value="Upload My File" />
</form>


<?
$filename=$_FILES['presentation']['name'];
//For size

if($_FILES["Upload"]["size"]>60000000) //60 mb
	{
	echo "File size should be less than 6MB";	
	}

// for extention

$ext = substr($filename, strpos($filename,'.'), strlen($filename)-1);

if($ext=='jpg' || $ext=='gif' )
{
echo "write the code to upload file";
}
else
{
echo "Only jpg or gif file is allowed";
}
?>

[Josh Connerty]

Thanks for the replies, from what I can gather PHP uploads the file to a temporary directory before running the first line of the script anyhow. Is there a way I can safely validate the file before PHP uploads it to a temp directory.

Also from what I gather the accept attribute isn't trustworthy as only a small percentage of browsers even register this attribute as being there.

[BzzBee]

Is your issue resolved now?

[Josh Connerty]

No

[shashank.kuls]

I've used the same code but if I try to upload file more than 200MB it won't show any error message
And I've set the limit of 2 MB .
It works for 5 Mb

[shashank.kuls]

I've used the same code but if I try to upload file more than 200MB it won't show any error message
And I've set the limit of 2 MB .
It works for 5 Mb

[cwarn23]

First make your form something like the following:

<form enctype="multipart/form-data" action="uploader.php" method="POST">
Upload File:
<input name="Upload Saved Replay" type="file" accept="image/gif, image/jpeg"/><br />
Below line is the essential line.
<input type="hidden" name="MAX_FILE_SIZE" value="200000000" />
<input type="submit" value="Upload File" />
</form>

And in the php side, add the following to the top of your page:

<?
ini_set('upload_max_filesize','200M');

[shashank.kuls]

Thanks But I've solved this issue..........
Use $_SERVER after trying to upload file. This variable returns size of uploaded file, even if upload failed

[marktoyota]

What type of file you are uploading, Image of Video file??? have you got solution or still looking for solution.

[Josh Connerty]

What type of file you are uploading, Image of Video file??? have you got solution or still looking for solution.

I am actually still having the issue I can change the settings in my ini but what I am trying to do is validate all the information about the uploaders file before they actually upload it else they spend maybe 5 minutes or so uploading the file to be told it has the wrong extension...

This is a big issue and has ground the work down to a halt.

[cwarn23]

It is possible to use html to validate the file format simply by using the accept= method in the upload field. Below is an example that only accepts gif files and jpeg files:

<input name="Upload Saved Replay" type="file" accept="image/gif, image/jpeg"/>