php fopen dynamic file path - php

Question

I am trying to make simple script that would allow user to upload image to my database. I have problem with php fopen function.
I need to allow user upload any image file on his computer so path to the file is different every time.
<form method="POST">
<input type="file" name="img">
<input type="submit" value="uload">
</form>
This simple form is returning only string value of file and i need to open the file using fopen function that needs direct path to the file.
fopen($_POST["img"],"r");
This works only if file is in the same directory as php script.
So I am asking if there is a way how to find where the file is stored so i could open it using fopen function.

Answer 1

I would advice you first to have look to PHP manual about file uploads: http://www.php.net/manual/en/features.file-upload.post-method.php
Because such code may open security hall in your system. Generally speaking it is not recommended to directly execute users files before doing some check like virus scan, binary signature of the images, image validaty by trying to resize it, etc.. From performance perspective it is not recommended to save them in database. In addition if you choose to upload to a directory its permission should set proper.
I will copy here sample file upload code modified to your case from the PHP manual:
HTML Part:
<!-- The data encoding type, enctype, MUST be specified as below -->
<form enctype="multipart/form-data" action="YOUR_Upload_FILE.php" method="POST">
<!-- Name of input element determines name in $_FILES array -->
<input name="img" type="file" />
<input type="submit" value="Send File" />
</form>
PHP Part:
<?php
$uploaddir = '/var/www/uploads/';
$uploadfile = $uploaddir . basename($_FILES['img']['name']);
//At this point you may like to check:
/*
1. Upload Errors in $_FILES
2. Do virus check.
3. Do binary check for the images type
4. Do size check for the image
5. Do actual image resize to confirm it is valid image.
*/
//After everything is safe, you move the temporary file to your permanent store.
echo '<pre>';
if (move_uploaded_file($_FILES['img']['tmp_name'], $uploadfile)) {
echo "File is valid, and was successfully uploaded.\n";
} else {
echo "Possible file upload attack!\n";
}
echo 'Here is some more debugging info:';
print_r($_FILES);
print "</pre>";
?>

Answer 2

if ($_FILES["file"]["error"] == 0) {
fopen($_FILES["img"]["tmp_name"], 'r');
}