Member Avatar for kaakka

#

how can use file extension like .txt,.php,.html for the same script.
anybody can help
<?php
if ($_POST['variable'] == '')
{
$variable = './'; // default folder
}
else
{
$variable = $_POST['variable'] ;
}
$folder = $variable;
$uploadpath = "$folder/";
$max_size = 2000;
$alwidth = 900;
$alheight = 800;
$allowtype = array( 'bmp', 'gif', 'jpg', 'jpe', 'png');
if(isset($_FILES['fileup']) && strlen($_FILES['fileup']['name']) > 1) {
$uploadpath = $uploadpath . basename( $_FILES['fileup']['name']);
$sepext = explode('.', strtolower($_FILES['fileup']['name']));
$type = end($sepext);
list($width, $height) = getimagesize($_FILES['fileup']['tmp_name']);
$err = '';
if(!in_array($type, $allowtype)) $err .= 'The file: <b>'. $_FILES['fileup']['name']. '</b> not has the allowed extension type.';
if($_FILES['fileup']['size'] > $max_size*1000) $err .= '<br/>Maximum file size must be: '. $max_size. ' KB.';
if(isset($width) && isset($height) && ($width >= $alwidth || $height >= $alheight)) $err .= '<br/>The maximum Width x Height must be: '. $alwidth. ' x '. $alheight;
if($err == '') {
if(move_uploaded_file($_FILES['fileup']['tmp_name'], $uploadpath)) {
echo 'File: <b>'. basename( $_FILES['fileup']['name']). '</b> successfully uploaded:';
echo '<br/>File type: <b>'. $_FILES['fileup']['type'] .'</b>';
echo '<br />Size: <b>'. number_format($_FILES['fileup']['size']/1024, 3, '.', '') .'</b> KB';
if(isset($width) && isset($height)) echo '<br/>Image Width x Height: '. $width. ' x '. $height;
echo '<br/><br/>Image address: <b>http://'.$_SERVER['HTTP_HOST'].rtrim(dirname($_SERVER['REQUEST_URI']), '\\/').'/'.$uploadpath.'</b>';
}
else echo '<b>Unable to upload the file.</b>';
}
else echo $err;
}
?>
<div style="margin:1em auto; width:333px; text-align:center;">
<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="POST" enctype="multipart/form-data">
Upload File: <input type="file" name="fileup" /><br/>
<select name="variable" />
<option value="" selected="selected">Select a folder</option>


<html>
<body>
<form name="input" action="upload.php" method="post" onchange="this.form.submit()">
<?php
$dirs = glob("*", GLOB_ONLYDIR);
foreach($dirs as $val){
echo '<option value="'.$val.'">'.$val."</option>\n";
}
?>
</select>
<input type="submit" name='submit' value="Upload" />
</div>
</form>
</body>
</html>
Edited by kaakka because: mistake
  • 3 Contributors
  • 3 Replies
  • 359 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by mattster

Dani AI

Generated

A short, practical plan to allow .txt and .html uploads while avoiding the common security and logic mistakes in the thread.

The original script in Post #1 validates images and calls image-only functions; the “type not allowed” problem comes from treating image- and text-upload paths the same. Replies from and correctly flag security and array-handling concerns. To accept text/HTML safely, treat those uploads as non-executable user content and add explicit server-side checks and storage rules.

Checklist (actions that close the gaps left by the current code):

  • Keep uploads outside the webroot and serve them through a controlled downloader/renderer so files never execute directly.
  • Validate both extension and MIME (server-side) using the fileinfo API rather than trusting the client filename.
  • Skip image-only checks (getimagesize) for non-image uploads; branch logic by detected MIME class.
  • Normalize and randomize stored filenames; save original names to metadata only. Set restrictive file-permissions.
  • Prevent execution in the upload directory (server config/.htaccess) and, if HTML must be viewable, sanitize or sandbox it (CSP or iframe sandbox) before rendering.
  • Limit file size and reject files that contain server-side code markers (for example, "<?php") when the intent is to accept plain text or safe HTML.

Example: detect MIME, map to a safe extension and move with a randomized name.

$finfo = new finfo(FILEINFO_MIME_TYPE);
$mime  = $finfo->file($_FILES['fileup']['tmp_name'] ?? '');
$map   = ['text/plain'=>'txt', 'text/html'=>'html'];
if (! isset($map[$mime])) { /* reject */ }
$ext = $map[$mime];
$target = __DIR__ . '/../uploads/' . bin2hex(random_bytes(8)) . ".$ext";
move_uploaded_file($_FILES['fileup']['tmp_name'], $target);

Finally, follow ’s safety warning about executable uploads and use ’s idea of keeping types logically separated (but implement the merge/lookup correctly). Check PHP error logs and inspect the actual MIME returned when troubleshooting; mismatches between extension and reported MIME are a common root cause.

Recommended Answers

All 3 Replies

Member Avatar for veedeoo

add the extension to

$imagetype = array( 'bmp', 'gif', 'jpg', 'jpe', 'png');
$file_type = array('txt','html');

PHP file should not be allowed to be upload in your server due to security reason.

find what is the extension of the upload and then check if it is an image or a file. If image use the image validation on your script, if it is a file validate the file accordingly.

Member Avatar for kaakka

showing file type not allowed! my changes are giving below

    $allowtype = array("$imagetype,$file_type");
    $imagetype = array( '.bmp', '.gif', '.jpg', '.jpe', '.png');
    $file_type = array('.txt','.html');
Edited by kaakka because: mistake
Member Avatar for mattster 
$allowtype = array_merge($imagetype, $file_type);

Because you're using a double quote, your two variables aren't being inserted into the array. Use array_merge(), it will combine both of your arrays accurately.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.