mysql - php script for upload image not working -

-

i have edit page allow users upload profile image using forms problem keep getting the format not acceptable if image type 1 of accepted format.

this code

if(isset($_post['parse_var']) == "pic")     {         if(!$_files['filefield']['tmp_name'])         {             $errormsg = '<font color= "#ff0000">please browse image  before press button.</font>';         }         else         {             $maxfilesize = 51200;//in bytes =  50kb             if($_files['filefield']['size']>$maxfilesize)             {                 $errormsg = '<font color="#ff0000">your image large, please try again.</font>';                 unlink($_files['filefield']['tmp_name']);             }             elseif(!preg_match("^.(gif|jpg|png)$/i^",$_files['filefield']['name']))             {                 $errormsg = '<font color="#ff0000">your image not 1 of accepted format, please try again</font>';                 unlink($_files['filefield']['tmp_name']);             }             else             {                 $newname = "image01.jpg";                 $place_file = move_uploaded_file($_files['filefield']['tmp_name'],"members/$id/".$newname);                 $message='<font color="#00ff00>your image has been upload successfully</font>';             }         }//end else      }//end if

major problems:

a)

        elseif(!preg_match("^.(gif|jpg|png)$/i^",$_files['filefield']['name']))                             ^---

you should not using regex metachar pattern delimiter. try

preg_match('/\.(gif|jpg|png)$/i', ...) instead.

but in bigger picture view, shouldn't matching on filenames @ all. filenames can forged. should doing server-side mime-type determination (e.g. via file_info()) instead.

b)

you not checking upload success. presence of ['tmp_name'] in $_files array means nothing. failed uploads can still produce tmp_name, yet end garbage. use this:

if ($_files['filefield']['error'] !== upload_err_ok) {    die("upload failed error code " . $_files['filefield']['error']); }

the error codes defined here: http://php.net/manual/en/features.file-upload.errors.php

c) (minor)

you no need unlink temp files. php automatically when script exits.

d) (stylistically huge error)

font tags? in 2013? 1990s called , want html 1.0 back...


Comments

Post a Comment

Popular posts from this blog

java - Jmockit String final length method mocking Issue -

-
using jmockit 1.2 jar, trying mock string's length method getting unexpected invocation exception: failed: test java.lang.illegalstateexception: missing invocation mocked type @ point; please make sure such invocations appear after declaration of suitable mock field or parameter @ stringdemo.testa$1.<init>(testa.java:17) @ stringdemo.testa.test(testa.java:13) i using testng: @test public void test() throws exception { new expectations() { @mocked("length") string astring; { astring.length(); result = 2; } }; system.out.println(a.showa("test")); } } actual class a: public class { public static int showa(string str){ int a= str.length(); return a; } } this wrong way of recording expected results. shouldn't mock , record string's length() method, record showa() instead. here solution @suppresswarnings("unused...
Read more

What is the difference between data design and data model(ERD) -

-
i have google question , find answer in day. know, data design many many table have list column,and mark pk , fk. why er-diagram have find this? data design process of designing database. main output of data design detailed logical data model of database. some people data design includes of needed logical , physical design choices , physical storage parameters needed generate design in data definition language. technically, database analysis, database analysts (dbas) trained do. while person can both data design , database analysis, these 2 different tasks. data design models data. database analysis takes model , applies 1 or more database engines (relational, hierarchical, nosql). a logical data model 1 of main outputs of data design. data model represented entity relationship diagram, or er diagram.
Read more

ios - Can NSManagedObject conform to NSCoding -

-
i need transfer single object across device. right converting nsmanagedobject dictionary , archiving , sending nsdata. upon receiving unarchiving it. transfer nsmanagedobject archiving , unarchiving instead of creating intermediate data object. @interface test : nsmanagedobject<nscoding> @property (nonatomic, retain) nsstring * title; @end @implementation test @dynamic title; - (id)initwithcoder:(nscoder *)coder { self = [super init]; if (self) { self.title = [coder decodeobjectforkey:@"title"]; //<crash } return self; } - (void)encodewithcoder:(nscoder *)coder { [coder encodeobject:self.title forkey:@"title"]; } @end nsdata *archivedobjects = [nskeyedarchiver archiveddatawithrootobject:testobj]; nsdata *objectsdata = archivedobjects; if ([objectsdata length] > 0) { nsarray *objects = [nskeyedunarchiver unarchiveobjectwithdata:objectsdata]; } the problem above code is. crashes @ self.title in initwithcoder sa...
Read more