Question

My form has a input file type field.

<input type="file" name="file" size="80" value="">

when submitted and this field is empty the file upload part of my php script should be skipped. This does not seem to be happening. What I am getting is the wrong file type message popping. Nothing was populated in the field on the form so why is my if/else statement not being followed? What am I doing wrong?

<?php
// connect to datebase
require "master.db.php";


// this if(empty statement is not working?
// should be checking to see if the form field 'file' is populated if so check file
// type if not skip and update sql database with information in form field 'test'
if(!empty($_FILES))
{
    if ((($_FILES["file"]["type"] == "image/gif")
    || ($_FILES["file"]["type"] == "image/jpeg")
    || ($_FILES["file"]["type"] == "image/pjpeg"))
    && ($_FILES["file"]["size"] < 2097152))
    {
        // code here works - function is to upload the file - not part of my current problem
    }

    // currently this else statement is displayed regardless of 'file' input
    // wrong function for its intended purpose
    else
    {
        // wrong file type
        echo "Invalid file <br />";
        echo "Tryed to upload: " . $_FILES["file"]["name"] . "<br />";
        echo "Type: " . $_FILES["file"]["type"] . "<br />";
        echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb Max 2Mb <br />";
        echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />";
        die;
    }
}
else 
{
// update other data in mysql database
$sql="UPDATE `characters` SET test='$test' WHERE ID='$id'";
$result=mysql_query($sql);

    // if successfully updated mysql.
    if($result){
        echo "<b>Update successful</b> <br />";
        echo "<a href='test.html'>View result</a>";
        touch('master.html');
        clearstatcache();
    }
    else
    {
        echo "Whoops: " . mysql_error(); ;
    }
    mysql_close();
}
?>

Answer 1

The browser will still send the input value, even though the value is empty. As a consequence, PHP will populate the $_FILES array with something like:

Array
(
    [file] => Array
        (
            [name] => 
            [type] => 
            [tmp_name] => 
            [error] => 4
            [size] => 0
        )

)

So instead of checking with isset/empty, I guess you should use PHP’s native is_uploaded_file method. See this SO post for more info on checking if an optional file input was provided.

I’ll try to clarify my answer. The reference I just gave suggests using file_exists and is_uploaded_file. According to the PHP manual only using is_uploaded_file is sufficient. In fact, I can imagine is_uploaded_file looks up the file anyway (so internally already does something like file_exists).

Please note that you really should use the tmp_name-key instead of the name-key. The ‘name’ key specifies the name of the file on the client’s PC, but the tmp_name specifies the name on the server. There are situations when the server renames the file and therefore differs from the name on the users PC.