Question

So im here trying to learn more php and… trying to add an image that a user would upload(an avatar) to the server via move_uploaded_file…oh and im on WAMP right now fyi.

the book im reading …long story short, the example shown doesnt work. Ive Googled around and literally copy pasted a few relavant examples ive found and still….well to be clear, be it that i wrote it or from the net, i can upload the image name (along with other values) to tables on the db i have set up but the image itself doesn’t move to the directory I’ve set up for it.

I’ve stripped all my apps code to a simple table and simple php to make sure nothing was conflicting etc, and still nada.

here is my html:

<form method="post" action="testUpload.php" enctype="multipart/form-data">

<input type="hidden" name="MAX_FILE_SIZE" value="32768" >

<table summary="guitarwars lesson" width="500">
        <tr>
            <td>load picture:</td>
            <td><input type="file" name="screenshot" id="screenshot" ></td>
        </tr>
        <tr>
            <td><input type="submit" name="submit" action="submit"></td>
        </tr>
</table>


</form>

here is my php:

<?php 

$screenshot = $_FILES['screenshot']['name'];
//$destination = "images/user_avatars/$screenshot";
$insertValues = "INSERT INTO testdb(screenshot) VALUES ('$screenshot')";


//---declare connection.
$connect2db = mysqli_connect('127.0.0.1','root','pass','dbname');
if(!$connect2db){
    die("Sorry but theres a connection to database error" . mysqli_error);
} else {

    //pg intro mssg
    echo ' <span style="font-size:25px; color:green;"> --- Link Established with Database ---.<span/><br/><br/>';   
}


// put into db.
if(!empty($screenshot)) {
    $insertData = mysqli_query($connect2db, $insertValues);
    echo 'data submitted. thank you';

        move_uploaded_file ($_FILES['screenshot']['tmp_name'],"images/user_avatars/{$screenshot}");


        echo 'IMAGE UPLOAD COMPLETE';

}
mysqli_close($connect2db);
?>

now i dont get an error…i actually get the echo “image upload complete” part…
and like i said, with the app code, i get multiple values AND the image name going through and being saved onto the db, but the image itself being moved from temp to my location is a no go.

any tips links, etc i gladly appreciate.
Thank you in advance.

Answer 1

If that’s code from your book, then throw the book out and burn it as fast as you can.

a) You’re wide open to SQL injection attacks. Any decent PHP tutorial that shows how to deal with databases should START with sql injection attack mitigation strategies.

b) Your connection-failed error uses mysqli_error, which is an undefined constant. You probably want mysqli_error(), which is a function call

c) The code assumes the upload completed successfully. Uploads can/will fail at the drop of a hat, so NOT checking for errors is the fast road to hair-pulling. At minimum the script should have something like

if ($_FILES['screenshot']['error'] !== UPLOAD_ERR_OK) {
   die("Upload failed with error code " . $_FILES['screenshot']['error']);
}

Those error codes are defined here.

d) Your code is using the user-supplied filename to store the file onto the sever. Nothing says that a malicious user can’t hack the filename to include path information, so your code is actually allowing that nasty user to scribble on ANY file on your server which the webserver process has write access to. This is BAD

e) Your code also assumes the file move succeeded, without checking for errors. It should have at mininum

$status = move_uploaded_file(...);
if (!$status) {
     die("Move failed!");
}

or something similar.

f) Your code assumes that all the database queries succeeded. Even if your query string is 100% perfectly formed (yours aren’t, see (a) above), queries can fail for any number of other reasons. At bare mininum you should have:

$result = mysql_query(...) or die(mysqli_error());