Home/ Questions/Q 7830019
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-02T11:02:22+00:00

Okay, so I set up an upload engine for a website so that an

  • 0

Okay, so I set up an upload engine for a website so that an authenticated user can upload a audio file (a key) for a song in the library, but I come across this strange problem when I try to upload any file over 5MB.

I set my php.ini max filesize to 50MB by the way

Everything uploads properly, but there is no data associated with the file on the other end.

HTML CODE:

<form action="keyUpload.php?id=<?php echo $id;?>" method="post" enctype="multipart/form-data">
<p style="color:#fff;font-size:30px;font-family:Times">
Add a new Key:<br/><input name="uploaded" type="file" id="file"><br />
<input type="text" name="kname" id="kname" value placeholder="Key Name (Ex. Demo, A#, etc.)" style="width:300px;"><br/>
<button class="button">Upload File</button><br/>
<span style="font-size:12px;">*Max Filesize is 50 MB*</span>
</p>
</form>

PHP CODE:

<?php 
$id=$_GET["id"];
$name=$_POST["kname"];

$name = str_replace(" ","%20",$name);

$allowed_filetypes = array('.mp3','.m4a','.wav','.wma');

$filename = $_FILES['uploaded']['name'];
$ext = substr($filename, strpos($filename,'.'), strlen($filename)-1);

Both $filename and $ext are empty variables when I upload a file larger than 5 MB. In all other cases, this engine works perfectly.

When echoed, simply nothing happens, so obviously the engine will not save the file if it doesn’t exist. What’s going on?

var_dump:

array(0) { }

Thanks for all your help!

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Check for upload errors:

    if ($_FILES['uploaded']['error'] !== UPLOAD_ERR_OK) {
   die("Upload failed with error code " . $_FILES['uploaded']['error']);
}

    The error codes are defined here: http://www.php.net/manual/en/features.file-upload.errors.php

    As well, do NOT use filenames to validate the uploads. It is beyond trivial for a malicious user to fake a filename and upload malicious files, eg.

    ren nastyvirus.exe good_tune.mp3

    And don’t use string operations on filenames. There’s a whole whack of PHP functions for filename manipulation, e.g. http://php.net/basename

    • 0