Checking if file is larger than 1 MB - php

Question

I would like to ask your help. I wrote a code which checks if all the fields are filled in and if the file is not larger than 1 MB. If everything is correct the file successfuly uploads to MySQL database. But if the file size is larger than 1 MB the code stops working. The error doesnt show up and all the fields become empty. Here`s the code (some of it is in Lithuanian, sorry):
<?php
error_reporting(E_ERROR);
session_start();
if (isset($_SESSION['login'])){
include 'config.php';
$username = $_SESSION['login'];
$result = mysqli_query($db,"SELECT * FROM users WHERE username='$username'");
$rws = mysqli_fetch_array($result);
if($_SERVER['REQUEST_METHOD'] == 'POST') {
$autorius = mysqli_real_escape_string($db,$_POST['autorius']);$pavadinimas = mysqli_real_escape_string($db,$_POST['pavadinimas']);$puslapiai = mysqli_real_escape_string($db,$_POST['puslapiai']);$tema = mysqli_real_escape_string($db,$_POST['tema']);$pmintis = mysqli_real_escape_string($db,$_POST['pmintis']);$pveikejai = mysqli_real_escape_string($db,$_POST['pveikejai']);$aveikejai = mysqli_real_escape_string($db,$_POST['aveikejai']);$epizodas = mysqli_real_escape_string($db,$_POST['epizodas']);$nuomone = mysqli_real_escape_string($db,$_POST['nuomone']);$apie = mysqli_real_escape_string($db,$_POST['apie']);$foto = mysqli_real_escape_string($db,$_POST['foto']);$user_id = $rws['id'];
if (!empty($autorius) && !empty($pavadinimas) && !empty($puslapiai) && !empty($tema) && !empty($pmintis) && !empty($pveikejai) && !empty($aveikejai) && !empty($epizodas) && !empty($nuomone) && !empty($apie) && isset($foto) && $_FILES['foto']['size'] > 0 && $_FILES['foto']['size'] < 1000001) {
$fileName = $_FILES['foto']['name'];$tmpName = $_FILES['foto']['tmp_name'];$fileSize = $_FILES['foto']['size'];$fileType = $_FILES['foto']['type'];
$fp = fopen($tmpName, 'r');
$foto = fread($fp, filesize($tmpName));
$foto = addslashes($foto);
fclose($fp);
$query = "INSERT INTO books (id_user, autorius, pavadinimas, puslapiai, tema, pmintis, pveikejai, aveikejai, epizodas, nuomone, apie, foto, name, type, size) ".
"VALUES ('$user_id', '$autorius', '$pavadinimas', '$puslapiai', '$tema', '$pmintis', '$pveikejai', '$aveikejai', '$epizodas', '$nuomone', '$apie', '$foto', '$fileName', '$fileType', '$fileSize')";
$result = mysqli_query($db,$query);
$success = "Knygos aprašymas įkeltas";
echo $_FILES['foto']['size'];
}
else if (empty($autorius) || empty($pavadinimas) || empty($puslapiai) || empty($tema) || empty($pmintis) || empty($pveikejai) || empty($aveikejai) || empty($epizodas) || empty($nuomone) || empty($apie)) {
$error = "Užpildykite visus laukelius!";
}
else if (empty($foto)){
$error = "Pasirinkite viršelio nuotrauką!";
}
else if ($_FILES['foto']['size'] > 1000001){
$error = "Viršelio nuotraukos dydid neturi viršyti 1 MB!";
}
}
?>
<?php include 'bin/includes/header.html'; ?>
<div class="container">
<div class="row">
<div class="col-lg-12">
<h1 class="page-header">Įkelti knygos aprašymą
<small>Ikelkite savo knygos aprašymą</small>
</h1>
<ol class="breadcrumb">
<li>Pagrindinis
</li>
<li class="active">Įkelti knygos aprašymą</li>
</ol>
</div>
</div>
<div class="row">
<div class="col-md-8">
<form name="upload" id="upload" method="post" enctype="multipart/form-data">
<div class="control-group form-group">
<?php
if(isset($success)) {
echo '<label style="color: #44FF00;">';
echo $success;
echo '</label>';
}
else {
echo '<label style="color: #FF3700;">';
echo $error;
echo '</label>';
} ?>
<div class="controls">
<input type="text" class="form-control" name="autorius" maxlength="60" placeholder="Autorius" value="<?php if(!empty($_POST['autorius'])) echo $_POST['autorius'];?>">
<p class="help-block"></p>
</div>
<div class="controls">
<input type="text" class="form-control" name="pavadinimas" maxlength="255" placeholder="Pavadinimas" value="<?php if(!empty($_POST['pavadinimas'])) echo $_POST['pavadinimas'];?>">
<p class="help-block"></p>
</div>
<div class="controls">
<input type="text" class="form-control" name="puslapiai" placeholder="Puslapių skaičius" value="<?php if(!empty($_POST['puslapiai'])) echo $_POST['puslapiai'];?>">
<p class="help-block"></p>
</div>
<div class="controls">
<input type="text" class="form-control" name="pveikejai" maxlength="999" placeholder="Pagrindiniai veikėjai" value="<?php if(!empty($_POST['pveikejai'])) echo $_POST['pveikejai'];?>">
<p class="help-block"></p>
</div>
<div class="controls">
<input type="text" class="form-control" name="aveikejai" maxlength="999" placeholder="Antraeiliai veikėjai" value="<?php if(!empty($_POST['aveikejai'])) echo $_POST['aveikejai'];?>">
<p class="help-block"></p>
</div>
<div class="controls">
<textarea placeholder="Tema" rows="2" class="form-control" name="tema" maxlength="999" style="resize:none"><?php if(!empty($_POST['tema'])) echo $_POST['tema'];?></textarea>
<p class="help-block"></p>
</div>
<div class="controls">
<textarea placeholder="Pagrindinė mintis" rows="2" class="form-control" name="pmintis" maxlength="999" style="resize:none"><?php if(!empty($_POST['pmintis'])) echo $_POST['pmintis'];?></textarea>
<p class="help-block"></p>
</div>
<div class="controls">
<textarea placeholder="Siužetas" rows="5" class="form-control" name="apie" maxlength="2999" style="resize:none"><?php if(!empty($_POST['apie'])) echo $_POST['apie'];?></textarea>
<p class="help-block"></p>
</div>
<div class="controls">
<textarea placeholder="Įsimintiniausias epizodas" rows="3" class="form-control" name="epizodas" maxlength="2999" style="resize:none"><?php if(!empty($_POST['epizodas'])) echo $_POST['epizodas'];?></textarea>
<p class="help-block"></p>
</div>
<div class="controls">
<textarea placeholder="Nuomonė apie knygą" rows="3" class="form-control" name="nuomone" maxlength="999" style="resize:none"><?php if(!empty($_POST['nuomone'])) echo $_POST['nuomone'];?></textarea>
<p class="help-block"></p>
</div>
<div class="controls">
<label>Įkelti viršelį (max 1MB)</label>
<input name="foto" type="file" id="foto">
<p class="help-block"></p>
</div>
<button type="submit" class="btn btn-primary">Įkelti</button>
</div>
</form>
</div>
</div>
<?php include 'bin/includes/footer.html'; ?>
<?php } else {
header("location: index.php");
}
Thanks for your help!

Answer 1

You should use this to get the file size:
$size = filesize($_FILES['foto']['tmp_name']);
This returns the filesize in byte. One MB are 1048576 bytes. You should check for the function not returning false.
In general: You should use exceptions for this purpose, it is much simplier to check for a condition and then check again. If you just want to use if-else-statements, you should rearrange it (check for errors first and then upload the thing in the else-case).
Why are you not saving the files in filesystem? This is a lot easier...