Image upload script. Problem with image size & Ext

Hello.

im having problems with an upload script.

here is the HTML form

<form action="<?php echo $_SERVER['PHP_SELF'] ?>" method="post" enctype="multipart/form-data" name="form1">
<table width="261" border="0" cellspacing="0" cellpadding="0">
<tr>
<td colspan="2" bgcolor="#FEB30A">&nbsp;</td>
</tr>
<tr>
<td width="77" bgcolor="#E1E8F2">Upload Pic :</td>
<td width="173"><input name="pic" type="file" class="smalltxt" id="pic"></td>
</tr><input type="hidden" name="MAX_FILE_SIZE" value="25">
<tr>
<td>&nbsp;</td>
<td><input name="Submit" type="submit" class="smalltxt" value="Upload !"></td>
</tr>
</table>
</form>


here is the PHP code that does it all

if ($_POST['Submit'])
{
$location = 'upload/' . $_FILES['pic']['name'];
if($_FILES['pic']['size'] > $_POST['MAX_FILE_SIZE']){
$messages = 'File Too Large';
}
if(move_uploaded_file($_FILES['pic']['tmp_name'], $location)) { echo "success"; exit(); } //move the file over
else {
echo 'failed';
exit();


i don't understand how i can
1 : get it to only allow gif , jpg files to be uploaded ( its allowing everything at the moment )

2 : make sure it doesnt move files greater than 25kb

ive searched and read loads of posts but im still confused. if anyone helps it will be very much appreciated

thanks

Personally, I'd add an action to your html form, though I'm not certain it would be nessessary, I tend to combine all of my php scripts. In any case, for your image size, I'd change it so that your MAX_FILE_SIZE in your form is that of the kb value you are looking for. 25kb = 25600. Change it to that, and it should control the size fine.

As with the file size, create an allowedtypes array. You can easily create the value for it using getimagesize($_FILES['pic']['tmp_name']). Your allowedtypes array should look kind of like:

$allowedtypes = array(IMAGETYPE_GIF, IMAGETYPE_JPEG);

Then you compare using an in_array function. Heres an example modification for your code:


<form action="<?php echo $_SERVER['PHP_SELF'] ?>" method="post" enctype="multipart/form-data" name="form1">
<table width="261" border="0" cellspacing="0" cellpadding="0">
<tr>
<td colspan="2" bgcolor="#FEB30A">&nbsp;</td>
</tr>
<tr>
<td width="77" bgcolor="#E1E8F2">Upload Pic :</td>
<td width="173"><input name="pic" type="file" class="smalltxt" id="pic"></td>
</tr><input type="hidden" name="MAX_FILE_SIZE" value="25600">
<tr>
<td>&nbsp;</td>
<td>
<input type="hidden" name="action" value="doupload">
<input name="Submit" type="submit" class="smalltxt" value="Upload !">
</td>
</tr>
</table>
</form>



if ($_POST['action'] == 'doupload')
{
$location = 'upload/' . basename($_FILES['pic']['name']);
$image = getimagesize($_FILES['pic']['tmp_name']);
$allowedtype = array(
IMAGETYPE_GIF,
IMAGETYPE_JPEG
);

if (!in_array($image[2], $allowedtype))
{
echo 'Image Invalid Type!';
exit;
}
if ($_FILES['pic']['size'] > $_POST['MAX_FILE_SIZE'])
{
echo 'Filesize too large!';
exit;
}

if(move_uploaded_file($_FILES['pic']['tmp_name'], $location))
{
echo 'Success!';
exit;
}
else
{
echo 'Failure...';
}

exit;
}

Hope this is what you are looking for.