Testing error with file upload If statements in PHP - php

Question

This is my first post on Stack Overflow so please be patient with me - I've resorted to posting because I can't find an answer via Google/Stack Overflow otherwise.
I'm new to PHP and learning how to add file uploads. I have a very basic html form that leads to a PHP page.
<form action="UploadPage.php" method="post" enctype="multipart/form-data">
<input type="hidden" name="MAX_FILE_SIZE" value="100000"/>
<input type="file" name="uploadedXML"/>
<input type="submit" value="Upload"/>
The PHP code which processes the file upload has a series of if statements to check whether file is the right type size etc. If there is an error, an appropriate error message is generated on an error page.
I've been testing uploading various file types to ascertain whether the error statements are occurring properly and I'm having trouble with the second (check for file type) and third (check for file size).
If the file type check if statement comes first, I'm finding that if I upload an XML file bigger than the max size (100kb) I still get the error message pertaining to the file type check - when I should be getting the error message pertaining to the file size.
However if i swap the IF statements around so the file size check comes before the file type check, if i upload the incorrect file type but of an agreeable size (eg a small image) I get an error message pertaining to the file being too big, when I'm expecting one pertaining to the file type being incorrect.
<?php
const UploadKey = 'uploadedXML';
const AllowedTypes = ['application/xml','text/xml'];
session_start();
/*Checking for errors*/
if (empty($_FILES[UploadKey]['name'])){//check file actually been uploaded
header("Location: ErrorPage.php");
$_SESSION['errorMessage']="You forgot to add your file!";
die();
}
if (!in_array($_FILES[UploadKey]['type'],AllowedTypes)){//Check correct type of file
header("Location: ErrorPage.php");
$_SESSION['errorMessage']="We only accept XML files I'm afraid";
die();
}
if ($_FILES[UploadKey]['error'] == 2) {//Check if size too big
header("Location: ErrorPage.php");
$_SESSION['errorMessage']="Your file is too big for us to handle, awkward! Please choose a file under 100KB.";
die();
}
$tempFileLoc = $_FILES[UploadKey]['tmp_name'];
$destFileLoc = 'Uploads/'.$_FILES[UploadKey]['name'];
if (file_exists($destFileLoc)) {// Check if file already exists
header("Location: ErrorPage.php");
$_SESSION['errorMessage']="We've already got this file, thanks though";
die();
}
if ($_FILES[UploadKey]['error']>0){
header("Location: ErrorPage.php");
$_SESSION['errorMessage']="Unfortunately there's been an error with the uploading process";
die();
}
Please let me know if you need to see any more of my code to help in answering.
Thanks very much in advance!

Answer 1

Best practice is to build up an error array and if its empty continue to your next step or if not return the errors. You could try something like this. In your code you were overwriting error messages so you only saw the last to apply and not all of the messages that upload may have triggered.
<?php
const UploadKey = 'uploadedXML';
const AllowedTypes = ['application/xml','text/xml'];
$errors = array();
session_start();
/*Checking for errors*/
if (empty($_FILES[UploadKey]['name'])){//check file actually been uploaded
$errors[] = "You forgot to add your file!";
}
if (!in_array($_FILES[UploadKey]['type'],AllowedTypes)){//Check correct type of file
$errors[] ="We only accept XML files I'm afraid";
}
if ($_FILES[UploadKey]['error'] == 2) {//Check if size too big
$errors[] ="Your file is too big for us to handle, awkward! Please choose a file under 100KB.";
}
$tempFileLoc = $_FILES[UploadKey]['tmp_name'];
$destFileLoc = 'Uploads/'.$_FILES[UploadKey]['name'];
if (file_exists($destFileLoc)) {// Check if file already exists
$errors[] ="We've already got this file, thanks though";
}
if ($_FILES[UploadKey]['error'] > 0){
$errors[] = "Unfortunately there's been an error with the uploading process";
}
//if errors were found
if(!empty($error)){
header("Location: ErrorPage.php");
//beware this is now an array and not a single string
$_SESSION['errorMessage']= $errors;
die();
}

Answer 2

That issue was caused as a result of the MAX_FILE_SIZE you included in the HTML form.
If the file you are uploading exceeds the MAX_FILE_SIZE set in the form, PHP automatically empties the tmp_name and type and also turns size to 0 for the file ($_FILES).
So $_FILES[UploadKey]['type'] is empty, thereby the condition you are using to check whether the file type is allowed will return false.
To correct that, you should also check to make sure the type is not empty as well
if (!empty($_FILES[UploadKey]['type']) && !in_array($_FILES[UploadKey]['type'],AllowedTypes)
Something like this:
<?php
if (!empty($_FILES[UploadKey]['type']) && !in_array($_FILES[UploadKey]['type'],AllowedTypes)){// Make sure the file type is not empty
header("Location: ErrorPage.php");
$_SESSION['errorMessage']="We only accept XML files I'm afraid";
die();
}