securing a upload form

Hey

I have an uploadform on my page that i only want to work with .jpg files and i have tried to make it work but i never got it, i hope someone could help me make this only work with .jpg files please?

<?php
$target = "images/";
$target = $target . basename( $_FILES['uploaded']['name']) ;
$ok=1;

if ($uploaded_size > 8500000)
{
echo "Your file is too large.<br>";
$ok=0;
}

if ($uploaded_type =="text/php")
{
echo "No PHP files<br>";
$ok=0;
}

if(move_uploaded_file($_FILES['uploaded']['tmp_name'], $target))
{
echo "The file ". basename( $_FILES['uploadedfile']['name']). " has been uploaded";
}
else {
echo "Sorry, there was a problem uploading your file.";
}
?> 

PHP:

 

you can use this
to check file jpg or other

<?php
$target = "images/";
$target = $target . basename( $_FILES['uploaded']['name']) ;
$ok=1;
if ($uploaded_size > 8500000)
{
echo "Your file is too large.<br>";
$ok=0;
}
if ($uploaded_type != "image/jpeg")
{
echo "we support jpg image only.<br>";
$ok=0;
}
if(move_uploaded_file($_FILES['uploaded']['tmp_name'], $target))
{
echo "The file ". basename( $_FILES['uploadedfile']['name']). " has been uploaded";
}
else {
echo "Sorry, there was a problem uploading your file.";
}
?>

PHP:

 

Hey

Thanks for this, but what i meant was that i only want to allow "jpg". If they try to upload other files like html php or other the script should not upload the file, with this code the file that "is not allowed" still get's uploaded to the server :/

 

If you want to check a file without uploading than I think you have to use javascript or jQuery. PHP cannot check the file without uploading (someone correct me if I am wrong here).

 

The best you'll probably get for a check is to use the GD module (if your PHP install has it available, if not you'll need to add it) and use imagecreatefromjpeg to try and load the image on the server -- if it fails, it's not a jpeg!
http://www.php.net/manual/en/function.imagecreatefromjpeg.php

That said, some advice: STOP using double quotes when you aren't escaping vars, avoid string addition on echo when you don't need it, if you're going to use boolean states use TRUE/FALSE instead of 0/1, and abort early if you know it shouldn't continue. Logging the errors to handle them post-action can also be more useful and allow for better semantic output.

You should also check if there are errors BEFORE you think about calling the move_uploaded_file function.

In other words, something more like this:

<?php

$target = 'images/' . basename( $_FILES['uploaded']['name']) ;
$errors = [];

if ($uploaded_size > 8500000) $errors[] = 'Your file is too large.';

if (
	($uploaded_type != "image/jpeg") ||
	!($image = imagecreatefromjpeg($_FILES['uploaded']['name']))
) $errors[] = 'We only support jpeg images.';

if (
	!count($errors) &&
	move_uploaded_file($_FILES['uploaded']['tmp_name'], $target)
) {

	echo '
		The file ', basename( $_FILES['uploadedfile']['name']), ' has been uploaded<br />';
	/*
		Since $image exists at this point, you could display it's properties
		like width, height, etc
	*/

} else $errors[] = 'Sorry, there was a problem uploading your file.';

if (count($errors)) {
	echo '
		<h2>Errors trying to upload your file!</h2>
		<ul class="errorList">';
	foreach ($errors as $message) echo '
			<li>',$errors,'</li>';
	echo '
		</ul>';
}

?>

Code (markup):

*note* if the above gives you an error on line 4, it means you're on an old/outdated version of PHP

 

Oh, actually, you might be better off using exif_imagetype
http://www.php.net/manual/en/function.exif-imagetype.php

Except it might reject perfectly valid JPEG files when they lack exif data - I've not played around with that one enough to say if it's good or not.

 

If you only want to check the .jpg extension without validating the file itself, then
if (!substr($target,-4) == '.jpg') exit;