--- Robert <[EMAIL PROTECTED]> wrote:
> This some code I found in a very helpful article at
>
> http://www.phpbuilder.com/columns/william19990908.php3?aid=41
>
> printable version of the same article at:
>
>
> http://www.phpbuilder.com/columns/william19990908.php3?print_mode=1
That is a rather old article (Sep 1999) and contains some practices which are
not advisable. For example:
> action="<?php echo $PHP_SELF ?>"
will work only if the php.ini configuration parameter register_globals is "on".
This should be avoided at all costs. You should instead refer to the
superglobal:
echo $_SERVER['PHP_SELF'];
> exec("cp $picture /full/path/to/joesauto/images/$picture_name");
Another dangerous practice. You should look at the newer PHP functions such
as:
http://www.php.net/is_uploaded_file
http://www.php.net/move_uploaded_file
The version in the tutorial attempts to use a Linux/Unix copy (cp) command to
move from a temporary location to a more permanent one. You should validate
the file before moving it into the web space. The is_uploaded_file() and
move_uploaded_file() functions provide better control over this process.
> echo "temp file: $picture<br>\n";
> echo "file name: $picture_name<br>\n";
> echo "file size: $picture_size<br>\n";
> echo "file type: $picture_type<br>\n";
> I understand everything up until the php code's last five to six
> lines. How did the author get "$picture_name" AND especially how id
> he get the variables"$picture_size" and "$picture_type".
Under the old system the form variable name associated with the file input (ie:
<input type='file' name='myfilename'>) becomes the base name of the variable
and the key attributes are defined in PHP (ie: $myfilename_size).
The preferred way of looking at this data is the $_FILES superglobal array. An
easy way to see this content is something like this:
printf("<pre>%s</pre>\n", print_r($_FILES,true));
You will see an array something like this:
Array
(
[myfilename] => Array
(
[name] => MyCoolPicture.jpg
[type] => image/jpeg
[tmp_name] => /tmp/phpzNghw7
[error] => 0
[size] => 4294
)
)
and you can extract the relevant data from each element of the $_FILES array.
File uploads can be highly dangerous to your server if not handled well. Make
sure you have a really good idea of what you are doing before you place
something on a server page seen by the outside world. Username/password
authentication is usually a good idea to ensure that not just anyone can upload
a file. Imagine if you were expecting and image and they really uploaded a PHP
script which was placed in the web space for them to run remotely on your
server.
James
_____
James D. Keeline
http://www.Keeline.com http://www.Keeline.com/articles
http://Stratemeyer.org http://www.Keeline.com/TSCollection
http://www.ITeachPHP.com -- Free Computer Classes: Linux, PHP, etc.
Summer Semester Begins Jun 20 -- New Classes Start Every Few Weeks.
Community email addresses:
Post message: [email protected]
Subscribe: [EMAIL PROTECTED]
Unsubscribe: [EMAIL PROTECTED]
List owner: [EMAIL PROTECTED]
Shortcut URL to this page:
http://groups.yahoo.com/group/php-list
Yahoo! Groups Links
<*> To visit your group on the web, go to:
http://groups.yahoo.com/group/php-list/
<*> To unsubscribe from this group, send an email to:
[EMAIL PROTECTED]
<*> Your use of Yahoo! Groups is subject to:
http://docs.yahoo.com/info/terms/
