Problems with Uploading Script [duplicate] - php

Question

This question already has an answer here:
Multiple Picture Upload Problems
(1 answer)
Closed 6 years ago.
I have a simple script that can upload files on my server and insert the details into database.
With code below I am getting two errors..
"Notice: Undefined variable: sExt in" ..
I tried to fix the issue with if empty statement, but without sucess..
Script import numbers (1,2,3...) into Mysql if the upload filed is empty....
I tried to fix the issue with the code below, but also without success..
"if($_FILES['files']['name']!="")"...
Any advice?
Thank you..
My code:
<?php
include_once('db.php');
if (isset($_FILES['files'])) {
$uploadedFiles = array();
foreach ($_FILES['files']['tmp_name'] as $key => $tmp_name) {
$errors = array();
$file_name = md5(uniqid("") . time());
$file_size = $_FILES['files']['size'][$key];
$file_tmp = $_FILES['files']['tmp_name'][$key];
$file_type = $_FILES['files']['type'][$key];
if($file_type == "image/gif"){
$sExt = ".gif";
} elseif($file_type == "image/jpeg" || $file_type == "image/pjpeg"){
$sExt = ".jpg";
} elseif($file_type == "image/png" || $file_type == "image/x-png"){
$sExt = ".png";
}
if (!in_array($sExt, array('.gif','.jpg','.png'))) {
$errors[] = "Image types alowed are (.gif, .jpg, .png) only!";
}
if ($file_size > 2097152000) {
$errors[] = 'File size must be less than 2 MB';
}
$query = "INSERT into user_pics (`person_id`,`pic_name`,`pic_type`) VALUES('1','$file_name','$sExt')";
$result = mysqli_query($link,$query);
$desired_dir = "user_data/";
if (empty($errors)) {
if (is_dir($desired_dir) == false) {
mkdir("$desired_dir", 0700);
}
if (move_uploaded_file($file_tmp, "$desired_dir/" . $file_name . $sExt)) {
$uploadedFiles[$key] = array($file_name . $sExt, 1);
} else {
echo "Files Uploaded !" . $_FILES['files']['name'][$key];
$uploadedFiles[$key] = array($_FILES['files']['name'][$key], 0);
}
} else {
print_r($errors);
}
}
foreach ($uploadedFiles as $key => $row) {
if (!empty($row[1])) {
$codestr = '$file' . ($key+1) . ' = $row[0];';
eval ($codestr);
} else {
$codestr = '$file' . ($key+1) . ' = NULL;';
eval ($codestr);
}
}
}
?>
<form action="" method="POST" enctype="multipart/form-data">
<input type="file" name="files[]" accept="image/*"> <br/>
<input type="file" name="files[]" accept="image/*"> <br/><br/>
<input type="submit"/>
</form>

Answer 1

instead of this
if($file_type == "image/gif"){
$sExt = ".gif";
} elseif($file_type == "image/jpeg" || $file_type == "image/pjpeg"){
$sExt = ".jpg";
} elseif($file_type == "image/png" || $file_type == "image/x-png"){
$sExt = ".png";
}
if (!in_array($sExt, array('.gif','.jpg','.png'))) {
$errors[] = "Image types alowed are (.gif, .jpg, .png) only!";
}
You should do
if($file_type == "image/gif"){
$sExt = ".gif";
} elseif($file_type == "image/jpeg" || $file_type == "image/pjpeg"){
$sExt = ".jpg";
} elseif($file_type == "image/png" || $file_type == "image/x-png"){
$sExt = ".png";
}else{
$errors[] = "Image types alowed are (.gif, .jpg, .png) only!";
}
Checking the extension you are setting is redundant, and this avoids the error when your varible $sExt is not set, by providing a default ( with else ). This should give you the desired behaviour.
I would also move these lines
$query = "INSERT into user_pics (`person_id`,`pic_name`,`pic_type`) VALUES('1','$file_name','$sExt')";
$result = mysqli_query($link,$query);
$desired_dir = "user_data/";
if (empty($errors)) {
To the inside of this code block
if (empty($errors)) {
$query = "INSERT into user_pics (`person_id`,`pic_name`,`pic_type`) VALUES('1','$file_name','$sExt')";
$result = mysqli_query($link,$query);
$desired_dir = "user_data/";
That way you don't do the insert when you have something in errors...
Not sure the purpose of this
foreach ($uploadedFiles as $key => $row) {
if (!empty($row[1])) {
$codestr = '$file' . ($key+1) . ' = $row[0];';
eval ($codestr);
} else {
$codestr = '$file' . ($key+1) . ' = NULL;';
eval ($codestr);
}
}
But eval can be very very bad, I would suggest doing this another way such as using an array, however this probably could be accomplished in the first loop. For example the null or false value could be in the else part of the check for empty($errors) so that if there is an error, that one is put in false like.
$files = array();
foreach ($uploadedFiles as $key => $row) {
if (!empty($row[1])) {
$files['$file' . ($key+1)] = $row[0];
} else {
$files['$file' . ($key+1)] = false; //id use false instead of null in an array
}
}
You should also be careful of sql injection, although it looks like you are setting the variables, its still wise to use a prepared query just in case changes are made latter, that could open you up to SQL injection attacks.

Answer 2

and:
// double slash
if (move_uploaded_file($file_tmp, "$desired_dir/" . $file_name . $sExt)) {
// file was successfuly moved
echo "Files Uploaded !" . $_FILES['files']['name'][$key];
$uploadedFiles[$key] = array($file_name . $sExt, 1);
} else {
$uploadedFiles[$key] = array($_FILES['files']['name'][$key], 0);
}
foreach ($uploadedFiles as $key => $row) {
if ($row[1]) { // $row[1] is never empty
${'file' . ($key+1)} = $row[0];
} else {
${'file' . ($key+1)} = NULL;
}
}
better will be:
if (move_uploaded_file($file_tmp, "$desired_dir/" . $file_name . $sExt)) {
echo "Files Uploaded !" . $_FILES['files']['name'][$key];
$uploadedFiles[] = $file_name . $sExt;
}
//instead of variable $file1 etc..
foreach($uploadedFiles as $filename){
}