File Uploading Script Problems

nikolai · December 11th, 2003, 01:35 PM

So you're having a register_globals problem, then? What's your register_globals setting? If it's "off" (which, as of php 4.1.0 is the default), then you'll need to fix the code as follows:

All your post data should be accessed via $_POST['varname'] instead of $varname. This includes $action and $SUBMIT.

All your server variables should be accessed via $_SERVER['varname'] instead of $varname. This includes $PHP_SELF.

For more info, search the site for register_globals posts. There are thousands. =) Start here:

  http://p2p.wrox.com/archive/beginnin...2002-11/17.asp
  http://www.google.com/search?q=site:...ster%5Fglobals

Also, read the manual section on file uploads:
  http://www.php.net/features.file-upload

Take care,

Nik
http://www.bigaction.org/

nhaslam · December 12th, 2003, 01:04 PM

The register_global is on. I have a working script for uploading files now. Thanks for your help.
I noted that even though the register_global is on, I still have to use $_POST['varname']. Don't really see why this would be the case?

nikolai · December 12th, 2003, 01:15 PM

Where do you have to use $_POST['varname']? My guess is that you're trying to access your global variables from within a function.

In a function, there are two ways of accessing global variables. 1) You can import global variables into function scope with the "global" keyword, and 2) you can access them via the $GLOBALS array. $GLOBALS is a "superglobal", which means it's ALWAYS in scope. That's what makes it "super". You don't have to explicitly import them into function scope.

I recommend trying to use $_POST['varname'] to access your form variables, even if register_globals is on. That way, you get in the habit of doing so for when you start writing new scripts geared toward stricter settings (i.e. register_globals = off and error_reporting = E_ALL)

For more information about variables, their scope, and the global keyword, read:
http://www.php.net/variables.scope

Take care,

Nik
http://www.bigaction.org/

phpnukes · January 8th, 2009, 09:13 AM

Please note that your servers may have upgraded their PHP version since this book was published in the year 2000. The current download source files donot all reflect these changes in PHP4 therefore chapter 10 the upload file looks to be affected. I will post an alternative code snippet here shortly.

Old Source code file_upload.php:

PHP Code:


			
<?
//file_upload.php
$archive_dir = "./docs";
function upload_form() {
   global $PHP_SELF;
?>
<FORM METHOD="POST" ENCTYPE="MULTIPART/FORM-DATA" 
   ACTION="<? echo $PHP_SELF ?>">
   <INPUT TYPE="HIDDEN" NAME="action" VALUE="upload">
   Upload file!
   <INPUT TYPE="FILE" NAME="userfile">
   <INPUT TYPE="SUBMIT" NAME="SUBMIT" VALUE="upload">
</FORM>
<?
}

function upload_file() {
   global $userfile, $userfile_name, $userfile_size, 
         $userfile_type, $archive_dir, $WINDIR;

   if(isset($WINDIR)) $userfile = str_replace("\\\\","\\", $userfile);
   
   $filename = basename($userfile_name);
   
   if($userfile_size <= 0) die ("$filename is empty.");

   if(!@copy($userfile, "$archive_dir/$filename"))
      die("Can't copy $userfile_name to $filename.");
   
   if(!isset($WINDIR) && !@unlink($userfile))
      die ("Can't delete the file $userfile_name.");

   echo "$filename has been successfully uploaded.<BR>";
   echo "Filesize: " . number_format($userfile_size) . "<BR>";
   echo "Filetype: $userfile_type<BR>";
}
?>
<HTML>
<HEAD><TITLE>FILE UPLOAD</TITLE></HEAD>
<BODY>
<?
if($action == 'upload') upload_file();
else upload_form();
?>
</BODY>
</HTML>

New Code to follow: