1. >> PHP: File Uploads

2. Uploading Files to Server
Pre-requisite
To Upload a file to the server using the <input type=“file”> tag, the following should be taken into consideration
Always use the POST method to submit form data
Add the attribute “enctype” to the form tag. Without this attribute, the file is not uploaded.
<form method=“POST” action=“add.php”
enctype=“multipart/form-date”>
Web-Based Systems - Misbhauddin

3. Inserting / Uploading Items to DB
<form method=“GET” action=“add.php>”
add.php? &image=/img/a.png&….
add.php
if(input type == file) {
Create associative array $_FILES
$_FILES = array();
$_FILES[‘image’] = array(‘name’ => ‘/img/a.png’,
‘tmp_name’ => ‘/abc/as/acd/a.png’,
‘size’ => xxxxx,
‘type’ => ‘image/png’; }
<input type=“file” name=“image>”
$_FILES
image
/img/a/png
/abc/as/acd/a.png
xxxxx
image/png
name
tmp_name
size
type
error
Web-Based Systems - Misbhauddin

4. Copy File to Local Folder &
File Upload Methods
File Upload Methods
Copy File to Local Folder &
Store the path in the DB
Store the file in the DB
BLOB
In order to upload files to the server, the form should declare another attribute
enctype="multipart/form-data"
Web-Based Systems - Misbhauddin

5. Step 1: Uploads Folder Initialization
Step 1: Initialize variable with the name of the folder you plan to store the file on the server
$target_path = “img/stuff/";
Processing Steps
Path you want to store the file on your server
Web-Based Systems - Misbhauddin

6. Step 2: Construct the Destination Path
Step 2: Strip the source directory and extract the filename (Use the basename function in PHP)
$target_path = $target_path . basename( $_FILES[‘image']['name']);
Concatenate the filename to the path
basename()
Return the trailing part of a path
basename("/etc/sudoers.d“)
Processing Steps
sudoers.d
Web-Based Systems - Misbhauddin

7. Step 3: Move File to Permanent Location
Processing Steps
Step 3: Move the file from the temporary directory to your server directory
source
$out = move_uploaded_file($_FILES[‘image']['tmp_name'], $target_path);
Move file from source to destination path
true
File transferred successfully
false
There was an error in the transfer process
Web-Based Systems - Misbhauddin

8. Factor 1: Check File Size
Decide to Keep or Remove the File
Factor 1: File is too large
if($_FILES[‘image’][‘size’] > xxxxx)
In bytes
Note: Always let the user know the max. file size you accept
Suggestion:
Create a hidden input filed with name MAX_FILE_SIZE and value equal to the maximum size
<input type=“hidden” name=“MAX_FILE_SIZE” value=“512000”>
Why: If we decide to change it in future, we can just change this value from the HTML file
Web-Based Systems - Misbhauddin

9. Factor 2: Check File Type
Decide to Keep or Remove the File
Factor 2: File type is right
if($_FILES[‘image’][‘type’] == ‘image/png’)
Issue: writing a condition for each type when you expect a class of files such as images or document
Solution: Checking it yourself
$ext = array("gif", "jpeg", "jpg", "png");
Array of all accepted extensions
$extension = end(explode(".", $_FILES["file"]["name"]));
Extract the extension of the file
Get the last element in the array
Splits the string into arrays at the given delimiter
if(in_array($extension, $ext)))
Check the extension
Subset function for arrays
Web-Based Systems - Misbhauddin

10. Factor 3 AND 4: Check For Errors
Decide to Keep or Remove the File
Factor 3: File uploaded successfully
if($_FILES[‘image’][‘error’] > 0)
Factor 4: File moved successfully
if($out = ‘true’)
Web-Based Systems - Misbhauddin

11. Inserting / Uploading Items to DB
Alternate Method to Upload Files
Step 1: Create a table that has a file column with type set to LONGBLOB
CREATE TABLE uploads (……, data LONGBLOB, … );
Reads entire file into a string
Step 2: Prepare the file
$image = addslashes(file_get_contents($_FILES[‘image’][‘tmp_name’]), filesize($_FILES[‘image’][‘tmp_name’])));
Returns the file size
backslashes before characters that need to be quoted
Step 3: Create and Run Query
$query="INSERT into uploads (……., image, ……) values (…….,'$image',……..)";
$result = mysqli_query($query);
Step 4: Check for all previous factors and display appropriate message to the user