Question

This baffles me. For some weird reason, move_uploaded_file() doesn’t put the file into the directory, yet it returns a valid tmp_name and name. So in this case $file always = to false.

Anyway, can anyone point some problems with this code? It would be greatly appreciated.

    <?php
include 'realtydevkit.php';
session_start();
$name = $_FILES['yourlogo']['name'];
$tmpname = $_FILES['yourlogo']['tmp_name'];

if ($name) {
    $directory = $name;
    $userid = $_SESSION['userid'];
    $type = "logo";

    $file = move_uploaded_file($tmpname, $directory);

    if ($file == true) {    
    mysql_query("INSERT INTO usercontent
    (`userid`, `type`, `url`) VALUES
    ('$userid', '$type', '$directory')");
    echo 'Uploaded';
    echo "<img src='".$directory."'/>";
    } else {
    echo 'There was an error moving the file.';
    }
}


?>

Answer 1

You’re not checking $_FILES['yourlogo']['error'], either.

Here is what you check with an uploaded file:

1. Check $_FILES['yourlogo']['error']. If it is UPLOAD_ERR_OK (0), then proceed.
2. Check is_uploaded_file($_FILES['yourlogo']['tmp_name']). If this fails, PHP doesn’t know what went wrong, but it doesn’t trust the file.
3. Assemble the destination path.
4. Use move_uploaded_file().

If move_uploaded_file() errors, then PHP can’t write the file at the destination. This is usually an invalid path or it doesn’t have permissions.

Note that $_FILES['yourlogo']['name'] is the name the file had on the uploader’s PC. It shouldn’t have any path information.