File not getting uploaded through curl in php - php

Question

I have an HTML code that allows me to upload the file successfully in server.
<form action="http://aa.bb.ccc.dd/xxx/upload.php" method="post" enctype="multipart/form-data">
<label for="text">Campaign:</label>
<input type="text" name="campaign" value="abcde" readonly="readonly"/><br/>
<label for="file">Upload type:</label>
<input type="text" name="filename" value="0.csv" readonly="readonly"/><br/>
<label for="file">Filename:</label>
<input type="file" name="file" id="file"/><br/>
<input type="submit" name="submit" value="Submit" />
</form>
I am writing an equivalent code in php to upload a file via curl. But the file does not get uploaded. Can anyone please help me on this. My php server code is as follows:
<code>$target_url = 'http://aa.bb.ccc.dd/xxx/upload.php';
$file_name_with_full_path = realpath('./upload/abc.txt');
$post = array('campaign' => 'abcde','file'=>'#'.$file_name_with_full_path,'filename'=>'5.csv');
$header = array('Content-Type: multipart/form-data');
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL,$target_url);
curl_setopt($ch, CURLOPT_HTTPHEADER, $header);
curl_setopt($ch, CURLOPT_POST,1);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
$result=curl_exec ($ch);
curl_close ($ch);
echo "Result: ".$result."\n";</code>
The result also gives 1, but the file is not uploaded when I check in the server. What is that I am missing?
Any help would be greatly appreciated!

Answer 1

I am interested in using PHP 'cURL'. This looks like a fairly standard requirement.
I looked at some of the 'cURL PHP examples on the web'.
Actually, using the code you have posted, there isn't anything really amiss that i can see.
Whatever, i have used your code and created similar scripts. Alas, you didn't post your 'upload.php' script. I have created one that does validation as mentioned in the PHP manual: http://www.php.net/manual/en/features.file-upload.php.
Although this example is for a 'localhost'. I have run it using a ' real' external host and it works fine.
Tested on PHP 5.3.18 on windows and Linux with PHP 5.3.28.
The Html form, was some confusion with labels as regards 'for':
<form action="process_uploaded_file.php" method="post" enctype="multipart/form-data">
<label for="text">Campaign:</label>
<input type="text" name="campaign" value="abcde" readonly="readonly"/><br/>
<label for="filetype">Upload type:</label>
<input type="text" name="filetype" value="0.csv" readonly="readonly"/><br/>
<label for="file">Filename:</label>
<input type="file" name="file" id="file"/><br/>
<input type="submit" name="submit" value="Submit" />
</form>
cURL Script:
<?php
$target_url = 'http://localhost/testmysql/process_uploaded_file.php';
$full_path_to_source_file = __DIR__ .'/sourcefiles/testupload1.csv' ;
$post = array('campaign' => 'abcde', 'file'=>'#'. $full_path_to_source_file, 'filename' => 'curl1.csv');
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL,$target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
$result=curl_exec ($ch);
curl_close ($ch);
var_dump($result);
Notice, no special 'enctype' header was required. Used the 'RETURNTRANSFER' option explicitly although the information was returned anyway.
Process Uploaded File script:
Implements a lot of recommended checks.
<?php session_start();
define('BIGGEST_FILE', 256 * 1024); // max upload file size
define('UPLOAD_DIRECTORY', 'P:/developer/xampp/htdocs/uploadedfiles'); // my data upload directory
if (empty($_FILES)) { // process the uploaded file...
die('no input file provided... '. __FILE__.__LINE__);
}
/* */
// validate the data -- see http://www.php.net/manual/en/features.file-upload.php
try {
// Undefined | Multiple Files | $_FILES Corruption Attack
// If this request falls under any of them, treat it invalid.
if ( !isset($_FILES['file']['error'])
|| is_array($_FILES['file']['error'])) {
throw new RuntimeException('Invalid parameters.');
}
// Check $_FILES['file']['error'] value.
switch ($_FILES['file']['error']) {
case UPLOAD_ERR_OK:
break;
case UPLOAD_ERR_NO_FILE:
throw new RuntimeException('No file sent.');
case UPLOAD_ERR_INI_SIZE:
case UPLOAD_ERR_FORM_SIZE:
throw new RuntimeException('Exceeded filesize limit.');
default:
throw new RuntimeException('Unknown errors.');
}
// You should also check filesize here.
if ($_FILES['file']['size'] > BIGGEST_FILE) {
throw new RuntimeException('Exceeded filesize limit.');
}
// DO NOT TRUST $_FILES['file']['mime'] VALUE !!
// Check MIME Type by yourself.
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mimeType = finfo_file($finfo, $_FILES['file']['tmp_name']);
/* */
if (false === $fileExt = array_search($mimeType,
array(
'jpg' => 'image/jpeg',
'png' => 'image/png',
'gif' => 'image/gif',
'csv' => 'text/plain',
),
true
)) {
throw new RuntimeException('Invalid file format.');
}
// check 'campaign' for safe in filename...
if (preg_match('/\w/', $_POST['campaign']) !== false) {
$campaign = $_POST['campaign'];
}
else {
$campaign = md5($_POST['campaign']); // sort of useful
}
// Now move the file to my data directory
// You should name it uniquely.
// DO NOT USE $_FILES['file']['name'] WITHOUT ANY VALIDATION !!
// On this example, obtain safe unique name from its 'campaign' and 'tmp_name'.
$destFilename = sprintf('campaign_%s_%s.%s',
$campaign,
sha1_file($_FILES['file']['tmp_name']),
$fileExt);
if (!move_uploaded_file($_FILES['file']['tmp_name'],
UPLOAD_DIRECTORY .'/'. $destFilename)) {
throw new RuntimeException('Failed to move uploaded file.');
}
echo $_FILES['file']['tmp_name'], ' uploaded to: ', UPLOAD_DIRECTORY .'/'. $destFilename;
} catch (RuntimeException $e) {
echo $e->getMessage();
}