[PHP] Very simple file uploader

[World Domination]

This is a very 'bare-bones' file uploader. It will take the file you specify, and upload it to your server.

You will need to create 2 new pages. One called 'uplaoder.php' (this is the page with the HTML formatting and whatnot), and one called 'upload.php' (this page will hold the PHP coding that does the uploading).

HTML:

<form action="upload.php" method="post" name="add-form" enctype="multipart/form-data">
<label for="file">
<div align="center"></div>
</label>
<div align="center"></div>
<div align="center">
  <p class="style1">Max upload file size: 100MB<br />
    <br />
    <span class="style2">Choose a File:</span><br />
      <input type="file" name="file" id="file" />
    <br />
    <input type="hidden" name="action" value="add" /> 
      <!-- Hidden input type -->
      <input type="submit" name="submit" value="Upload" />
    </p>
  </div>
</form>

PHP:

<?php 
if(isset($_POST['submit'])) {
	
	if($_POST['action'] == 'add') {
		// Folder where the file will be uploaded.
		$upload_path = './uploads/' . $_FILES['file']['name'];
		// Checks if the file already exists in the folder.
		if(!file_exists($upload_path)) {
			// Check the size of the file. 
						if($_FILES['file']['size'] < 100000000000 && $_FILES['file']['size'] > 0) {
				// If there are any errors.
				if($_FILES['file']['error']) {
					echo "Error: " . $_FILES['file']['error'];
				} else {
					// Success!
					echo "File successfully uploaded.<br /><br />";
					echo "The filename is: <strong>" . $_FILES['file']['name'] . "</strong><br />";
					echo "The filesize is: <strong>" . $_FILES['file']['size'] . "</strong><br />";
					echo "The filetype is: <strong>" . $_FILES['file']['type'] . "</strong><br />";
								
					// Move uploaded file to upload folder.
					move_uploaded_file($_FILES['file']['tmp_name'], $upload_path);
				}
			} else {
				echo $_FILES['file']['size'] < 1 ? 'Incorrect filename.' : 'File size is too big';
			} 
		} else {
			echo "File already exists in your folder. ";
		}
	}
}
?>

If you wish to rename the files, be certain that the 'form action=' int he HTML page is set to the correct file name for the page holding the PHP coding.

*Note: this will not upload a file larger than 100MB in most cases. Many web hosts limit the file size you can upload in the php.ini file and many times you do not have access to this file. Sometimes the file size will be even smaller that 100MB, check with your host before trying to upload and large files so you don't waste your time trying to upload a 100MB file when your hosts only allows 50MB sized files to be uploaded.

 

[iLike]

Can't say this is the best way of uploading files, this will allow anyone to upload any PHP script. PHP is a server-sided language, so people can actually gain full control (after some exploitation & fiddling around) over your server.
I have to go now but I'll post an example which filters out PHP files tomorrow or something.

 

[World Domination]

Can't say this is the best way of uploading files, this will allow anyone to upload any PHP script. PHP is a server-sided language, so people can actually gain full control (after some exploitation & fiddling around) over your server.
I have to go now but I'll post an example which filters out PHP files tomorrow or something.

Yes, I do know this, that's why I said it was a "very basic and bare bones" and don't actually recommend it to use to upload your files unless it's private, password protected, etc. I thought I put something like that in my initial post, but I guess I forgot to.
This script is pretty much for learning purposes only.

You could also limit the file types you can upload with a simple IF Statement, after calling an $allowed_types variable; something like:

$allowed_types = array('image/png');

if (in_array($_FILES['file_up']['type'], $allowed_types)) {

That would limit the uploader to only upload .png files.

 

[amazing horse]

thanks man

 

[patdaman45]

Thanks, this should come be very useful.

 

[Massive MK]

it's a good example if you ask me but only for protected directory's