Okay so a few days ago I finished a tutorial of photo gallery...I'm having problems of putting images other than jpg format...the one who made the tutorial said that you can add formats to be uploaded but he didnt show it..here was his code in his upload.php...I tried experimenting on it but I cant get it to work properly..

<?php
error_reporting(0);
mysql_connect('localhost','root','');
mysql_select_db('uslt');
?>
<html>
<head>

    <title>Album Gallery</title>
<link rel='stylesheet'  href='style.css'>
</head>
<body>
<div id='body'>
    <?php include('title_bar.php');?>
    <div id='container'>                                                                                                                              
        <h3>Upload Photos</h3>
        <form enctype='multipart/form-data' method='post'>
        <?php
            if (isset($_POST['submit'])) {
                $name= $_POST['name'];
                $album_id=$_POST['album'];
                $file=$_FILES['file']['name'];
                $file_type=$_FILES['file']['type'];
                $file_size=$_FILES['file']['size'];
                $file_tmp=$_FILES['file']['tmp_name'];
                $random_name=rand();

                if (empty($name) or empty($file)) {
                    echo "Please fill everything <br><br>";

                }else{
                    move_uploaded_file($file_tmp,'uploads/'.$random_name. '.jpg');
                    mysql_query("INSERT into photos values('','$name','$album_id','$random_name.jpg')");
                    echo "Photo Uploaded!";
                }
            }

        ?>
            Name: <br>
            <input type='text' name='name'>
            <br><br>
            Select Album:<br>
            <select name='album'>
                <?php
                    $query=mysql_query("SELECT id, name from albums");
                    while ($run=mysql_fetch_array($query)) {
                        $album_id=$run['id'];
                        $album_name=$run['name'];
                        echo "<option value='$album_id'>$album_name</option>";
                    }
                ?>
            </select>
            <br><br>
            Select Photo: <br/>
            <input type='file' name='file'>
            <br><br>
            <input type='submit' name='submit' value='Upload'>
        </form>
    </div>

</div>
</body>
</html>

Dani AI

Generated

Short summary and safe path forward: the upload worked only when you removed the hardcoded “.jpg” because the script was forcing that extension. The real fixes are (1) detect the uploaded file type on the server, (2) map that to a safe extension, (3) generate a collision-free filename, (4) move the file, and (5) store just the filename in the DB using prepared statements. That covers both functionality and security.

Why the earlier attempts failed or were risky: $_FILES['file']['type'] is a client-sent MIME string (for example image/jpeg) and should not be used as a filename extension. User-supplied values and MIME types can be forged. Also, as warned, rand() can collide. And pointed at the MIME field — useful idea but incomplete without server-side validation.

Example of a concise, safer flow (server-side type check, map to extension, unique name):

$allowed = ['jpg'=>'image/jpeg','png'=>'image/png','gif'=>'image/gif'];
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime = finfo_file($finfo, $_FILES['file']['tmp_name']);
finfo_close($finfo);
$ext = array_search($mime, $allowed, true);
if ($ext === false) { /* reject upload */ }
$unique = bin2hex(random_bytes(8));   // or uniqid() if older PHP
$target = __DIR__.'/uploads/'.$unique.'.'.$ext;
move_uploaded_file($_FILES['file']['tmp_name'], $target);

Final practical notes: use PDO or mysqli prepared statements instead of deprecated mysql_* when inserting the filename. Store only the generated filename in the DB, not the whole path. Protect the uploads folder (disable script execution via server config or .htaccess, or place uploads outside webroot). Limit file size and sanitize other inputs. About your Word-file experiment: modern Office formats like .docx are ZIP containers; they can appear as compressed archives in some file managers — that is why you saw a RAR/ZIP-like result.

Recommended Answers

All 10 Replies

I don't see a restriction in the code. I think you just have to replace the hardcoded .jpg with $_FILES['file']['type']

uhmm..what? i kinda tried it but maybe i did the wrong way..what exactly do you mean pritaes-sensei?

i kinda tried it but maybe i did the wrong way.

Show what you've tried.

move_uploaded_file($file_tmp,'uploads/'.$random_name. '.$_FILES['file']['type']');
                    mysql_query("INSERT into photos values('','$name','$album_id','$random_name.$_FILES['file']['type']')");

oh wait nevermind...I think I know what to do...wait...

false alarm lol...I still dont know how

oh wait i got it to work..hmmm...i removed .jpeg..i am able to upload other photos..i also tried word file though it isnt necessary for this photo gallery it gioves me a rar file lol...i wonder why

move_uploaded_file($file_tmp,'uploads/'.$random_name);
                    mysql_query("INSERT into photos values('','$name','$album_id','$random_name')");
  1. rand() will return a random number so your query will be: 'uploads/12324'). You need to put a file extension after it.
  2. Also, don't use this, because you might get two image with the same random number, and they'll overwrite each other.

You can't have $variable.'.$variable etc., because it will just think your second variable is text - try this instead:

move_uploaded_file($file_tmp,'uploads/'.$random_name.$_FILES['file']['type']);

PHP will stick the inverted commas in itself, so just stick thr variables in without 's either side of them.

thanks should I do the same with mysqlquery?

Yes you should.

Then just something like: <img src="<?= $photo['url']" ?>

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.