PHP File Upload returning extensions false - php

Question

I have a form which is meant to upload articles to my database within this form I have a file upload field the objectives of my file upload is as follows:
Limit file extensions to image format
Rename file to something random
Create a new directory based on the ID of the entry into the database
Keep the extension of the file that is uploaded
Every time I hit the submit button the form seems to think I have tried to upload a file that isn't in the list of allowed extensions, it prints this error (the fields however are uploaded to the database):
wrong files format , allowed only "Array"
I'm not quite sure why this is the case as I know I'm inputting the correct file format.
public function insert ($field) {
if ($stmt = $this->mysqli->prepare("INSERT INTO articles (title, story, storyb, storyc, author, date_created, section, youtubeid) VALUES (?, ?, ?, ?, ?, ?, ?, ?)")) {
/* Set our params */
$title = isset($_POST['title']) ? $this->mysqli->real_escape_string($_POST['title']) : '';
$story = isset($_POST['story']) ? $this->mysqli->real_escape_string($_POST['story']) : '';
$storyb = isset($_POST['storyb']) ? $this->mysqli->real_escape_string($_POST['storyb']) : '';
$storyc = isset($_POST['storyc']) ? $this->mysqli->real_escape_string($_POST['storyc']) : '';
$author = isset($_POST['author']) ? $this->mysqli->real_escape_string($_POST['author']) : '';
$date_created = isset($_POST['date_created']) ? $this->mysqli->real_escape_string($_POST['date_created']) : '';
$section = isset($_POST['section']) ? $this->mysqli->real_escape_string($_POST['section']) : '';
$youtubeid = isset($_POST['youtubeid']) ? $this->mysqli->real_escape_string($_POST['youtubeid']) : '';
/* Bind our params */
$stmt->bind_param('ssssssss', $title, $story, $storyb, $storyc, $author, $date_created, $section, $youtubeid);
/* Execute the prepared Statement */
$stmt->execute();
/* Echo results */
echo "Inserted {$title} into database\n";
/* Close the statement */
$stmt->close();
}
else {
/* Error */
printf("Prepared Statement Error: %s\n", $mysqli->error);
}
// Handling file upload
$extensions = array(".jpg",".jpeg",".gif",".png", ".JPG", ".JPEG", ".PNG", ".GIF");
$extension = strrchr($_FILES['uploadImage']['name'], '.');
$path = "../files/uploads/articles_gallery/" . $this->mysqli->insert_id;
$filename = uniqid(rand(), true);
if (!in_array($extension, $extensions))
{
echo'<center>wrong files format , allowed only <strong>"'.$extensions.'"</strong></center>';
} else {
if (!is_dir($path))
{
die('Error: ' . $mysqli->error());
}
echo "<h3>1 record added</h3>";
mkdir($path, 0777);
move_uploaded_file($_FILES['uploadImage']['tmp_name'], $path, $filename);
} // File Upload End
}
Insert.php
<div id="form">
<form action="insert.php" method="post" name="insert" id="articleform">
<input type="input" name="title" id="title" class="detail" id="title"/>
<textarea name="story" id="story" class="detail" placeholder="Insert article here"></textarea>
<input id="uploadImage" type="file" name="uploadImage" onchange="PreviewImage();" class="" />
<img id="uploadPreview" style="width: 250px; height: 200px;" />
<textarea name="storyb" id="storyb" class="detail" spellcheck="true" placeholder="Insert article here"></textarea>
<textarea name="storyc" id="storyc" class="detail" spellcheck="true" placeholder="Insert article here"></textarea>
<input type="input" name="author" id="author" class="detail"/>
<? $today = date("l j M Y"); // Monday 13 April 2013 ?>
<input type="hidden" name="date_created" id="date_created" class="detail" value="<? echo $today;?>" />
<input type="hidden" name="section" id="section" class="detail" value="game"/>
<input type="input" name="youtubeid" class="detail" id="youtubeid" />
<input type="submit" id="submit" name="submit" value="Submit Article " />
</form>

Answer 1

strchr() will give you true/false if the character (in your case, ".") exists in the string. So to get the file extension, you could use something like:
$extension = end(explode('.', $filename));
.. But maybe a function like pathinfo() could be usefull in this case too.
Furthermore, in your error message you use $extensions. This is a var with type "array", and thus the string representation is "Array". I think you meant $extension (without the S) there. Or, maybe, you want to list all correct extensions this way: implode(',', $extensions).
Note that checking on extensions is not a safe way to check what kind of content is present. I can easily upload a .exe, by just renaming it to .jpg.
Oh, and chmod-ing a directory/file to mode 777 is highly discouraged due to security reasons.

Answer 2

if you want to display the available extension you can't just concat your array with your message. you have to iterate all values.

Answer 3

The code to get extension is wrong.
$extension = strrchr($_FILES['uploadImage']['name'], '.');
change it to
$extension = strtolower(substr($_FILES['uploadImage']['name'],-3,3));
if extension is 3 characters long or explode()
and get the last parametr. This is not good way anyway, I prefer to check MIME type
$extension = strtolower(end(explode('.', $_FILES['uploadImage']['name'])));
change your extension array to
$extensions = array("jpg","jpeg","gif","png");
also add to your form
enctype="multipart/form-data"
your error message is wrong because you want to echo array instead of string use implode() to join array
implode(";",$extensions)

Answer 4

update your form from:
<form action="insert.php" method="post" name="insert" id="articleform">
To :
<form action="insert.php" method="post" name="insert" id="articleform" enctype="multipart/form-data">