If File Exists trouble

Smudly · 07-03-2010, 01:51 AM

I am working on a section for users to upload a picture/avatar on their profile. I noticed that if I have two different images with the same file name, and upload both of them, the first one is overwritten. I am trying to write a script that will find if file exists, randomize a set of numbers and letters, and use those as the files' new name.

In my code below, you can see that I am trying to replace the $name variable with this new set of characters. The problem is, that the name has the extension at the end of it as well. So this would cause an issue. So depending on what type of file the user is trying to submit, the extension will be concatenated at the end of the file name, then will upload it.

I'm getting no errors, and am stuck on what to do from here. The function creates a random string of characters for the name.

PHP Code:


			
<?php



$upload = $_POST['upload'];

if ($upload)

{

    // Name of file

$name = $_FILES["image"]["name"];

    // Type of file (video/avi) or image/jpg, etc

$type = $_FILES["image"]["type"];

    //size of file

$size = $_FILES["image"]["size"];

    //stores file in a temporary location

$temp = $_FILES["image"]["tmp_name"];

    // if there is an error

$error = $_FILES["image"]["error"];

echo $type;

function genRandomString() {

    $length = 10;

    $characters = '0123456789abcdefghijklmnopqrstuvwxyz';

    $string = '';    



    for ($p = 0; $p < $length; $p++) {

        $string .= $characters[mt_rand(0, strlen($characters))];

    }



    return $string;

}



if ($error > 0)

{

    $uploaderror = "An error occured. Please try again.";

}

else

{



if ($type=="image/jpeg" || $type=="image/png" || $type=="image/gif" || $type=="image/bmp" || $type=="image/jpeg")

{

    if ($size <= 5242880)

    {

        if(file_exists($name)){

        

        $name = genRandomString($string);

        

         

        }

        else

        {

            move_uploaded_file($temp, "avatars/".$name);

            $success = "Upload Complete!";

        }

    }

    else{

        $uploaderror = "Your image must be less than 5 megabytes.";

    }

}

else

{

die("That format is not allowed!");



}

}

}

?>

<html>

<h1>Upload a File</h1>

<form action="upload.php" method="POST" enctype="multipart/form-data">

    <input type="file" name="image"><br />

    <input type="submit" name="upload" value="Upload"><br />

    <?php echo $success, $uploaderror; ?>



</form>

</html>

rfresh · 07-03-2010, 05:08 AM

First off, you need to check and then limit file extensions for your images. jpg and gif and png and maybe some others. Reject all other extensions (you'll get .exe uploads to be sure). Don't assume all uploads will be an image type.

Next, strip off the last ".jpg" or ".gif", create your unique filename and then append the extension back on. Now you'll have your new image filename with the same extension.

ameenudeen · 07-03-2010, 08:27 AM

Hi,

You can rename the existing file using file rename code, example
rename("/tmp/tmp_file.txt", "/home/user/login/docs/my_file.txt"); you can get the extension for the file using the stirp off function

Regards
Ameen

Fou-Lu · 07-03-2010, 08:51 AM

Is the 'name' provided by the upload of any relevance other than extension? If not, looks like you want to select a name until it finds an unused.

PHP Code:


			
$ext = pathinfo($name, PATHINFO_EXTENSION);  
do
{
    $name = genRandomString() . '.' . $ext; 
} while (file_exists($name));

You can also open a file and read the first four bytes. That should tell you what type of file you have. Consider uploading above public_html, and serving with php; this will let you force an image header destroying an uploaded script for example.