Question

Please can someone help? I have the following code which uploads a file to my server and renames it to whoever the logged in user is. For example the user ‘coca-cola-lover’ uploads a jpeg – the script would also rename the jpeg ‘coca-cola-lover.jpg’.

My problem is that I need it to limit the upload to just jpegs – and also limit the file size to 2mb.

Please help – I was trying to find a solution all night.

Thanks in advance

    // Your file name you are uploading
$file_name = $HTTP_POST_FILES['ufile']['name'];
$username = $row_Recordset1['username'];

$ext = end(explode('.', $file_name));

$renamed_file_name = $username;

$new_file_name=$renamed_file_name.'.'.$ext;

//set where you want to store files
//in this example we keep file in folder upload
//$new_file_name = new upload file name
//for example upload file name cartoon.gif . $path will be upload/cartoon.gif
$path= "../sites/images/users/".$new_file_name;
if($ufile !=none)
{
if(copy($HTTP_POST_FILES['ufile']['tmp_name'], $path))
{
echo "Successful<BR/>";

//$new_file_name = new file name
//$HTTP_POST_FILES['ufile']['size'] = file size
//$HTTP_POST_FILES['ufile']['type'] = type of file
echo "File Name :".$new_file_name."<BR/>";
echo "File Size :".$HTTP_POST_FILES['ufile']['size']."<BR/>";
echo "File Type :".$HTTP_POST_FILES['ufile']['type']."<BR/>";
}
else
{
echo "Error";
}
}

Answer 1

getimagesize tells you what format the file is in

as per bgy’s comment, you should also force the file extension to be what you want:

 $new_file_name=$renamed_file_name.'.'.$ext; // wrong, uses data from the client

 $new_file_name=$renamed_file_name.'.jpg';   // ok, just what we want

never trust and never use filenames provided by the client.