Uploading Files with PHP
A handy trick with PHP is uploading files to your server using a web browser. You can do this with most versions of HTML as well, but using PHP allows you to put more limits and security on the upload. Warning: if you put this code on your page without also putting some security on it as well, it's easy for anyone who finds the page to upload any files they want to your web server. Your easiest way out is to put this script on a page that is behind some password protection.
Like all other PHP scripts, the uploading script is embedded in standard HTML.
<form enctype="multipart/form-data" action="upload.php" method="POST"> <input type="hidden" name="sizelimit" value="100000" /> What's the name of the file you want to upload? <input name="newfile" type="file" />
<input type="submit" value="Upload File" /> </form>
This is all HTML code, standard form stuff. In case you don't use forms, this is what the different parts of the code means:
- enctype="multipart/form-data" - This tells the HTML server what kind of script you're getting ready to run.
- action="upload.php" - This initiates the PHP script you're going to be running in order to upload your file. You haven't created the script yet; this is the next step.
- method="POST" - This tells the browser that you're going to be asking it to POST data, not just render a page.
- input type="hidden" name="sizelimit" value="100000" - This sets the maximum file size in bytes that you are allowing to upload. In standard HTML, this value is easy to override, but in the Upload script, there's a fix for that problem.
- input name="newfile" - newfile is the name the file being uploaded will have in your PHP script.
Once this form code is finished and placed in a regular web page, save it. Ours is saved as upload.html.
When a user browses this file, he will see a page that has your question, a blank with a Browse button next to it you can scan your own hard drive or other files for the file you want to upload, and a Submit button - about as simple as it gets. The user selects the file he or she wants and clicks Submit.
At this point, your server takes over. The data is posted to the server as a request to upload.php, the script you're going to create now. In this file, your form data is processed and the file that was uploaded is redirected to the proper location on your server.
Creating upload.php
Your PHP script normally would perform two basic tasks: it will decide whether to keep or discard the file, depending on how big it is and what type it is, and it will determine where to direct the file for storage. This one's only going to store the file.
When the form is executed on the web page, the uploaded file exists in a kind of computer limbo on the server. It is not moved to permanent storage unless your PHP script takes action; since it's only held in a temporary file, it will vanish if it's not stored.
Your PHP script is going to use the $_FILES associative array to store this file.
$_FILES Array
This array is where PHP stores all information associated with files. The two elements and one variable you need to understand are:
- newfile - This is the name assigned to the variable "name" in the HTML script written earlier, and it is the name by which PHP will refer to your new uploaded file.
- $_FILES['newfile']['name'] - Name is the original path of the file uploaded by the user
- $_FILES['newfile']['tmp_name'] - This is the path to the temporary file that is currently uploaded to the server.
Now that you know what your variables are, you can write your PHP upload manager script.
// This tells the server where you're going to put the new file $target_path = "uploads/"; /* This part gives your new file a name on the server, with the structure "uploads/filename.extension" */ $target_path = $target_path . basename( $_FILES['uploadedfile']['name']); // And you pull the file in with this part $_FILES['uploadedfile']['tmp_name'];
Before you can successfully run this script, you need to create a new directory where you want your uploaded files to go. It will need to be in the same directory that your upload script is saved in, and because of the way the script above is written, its name will need to be "uploads."
The function you are creating is going to be called move_new_file. It needs to know what the path of the temporary file is (you just told it) and the path it will be moved to (and you told it this as well.)
Your new code will be:
$target_path = "uploads/";
$target_path = $target_path . basename( $_FILES['newfile']['name']);
if(move_new_file($_FILES['newfile']['tmp_name'], $target_path)) {
echo "File ". basename( $_FILES['newfile']['name']). " has been uploaded";
} else{
echo "There was an error uploading this file; please try again!";
}
This is very straightforward code. You've named your variables already. The first line tells it what your target path for the file is. The second line tells it what to do with the file and how to name it.
The "if" statement has the code return a message to you to tell you whether the file has been successfully moved or not.
The Problem With This Code
As was mentioned earlier in this document, this code, if you just put it on a public page, will result in anyone being able to upload files to your server, including malicious executables. Never put this on a public area. Instead, place it in a private part of your website that is only available to those with a password, or put it on a secure intranet.
There are things you can add to this code to make it both more secure and more robust. For instance, you can use it to screen out file types you don't want, or to allow only certain file types. Unfortunately, these functions are too advanced for this article to address them.
Site Categories
Recent Blog Posts
