PHP Script is not Properly Uploading Images

Question

I'm working on a small, user-maintained online store, and am trying to allow my end user (the store administrator) to upload graphics for products. When I run this script, however, it doesn't actually store the image. I built this script from various tips here and a tutorial, and have gotten everything but the image upload portion to work.

// Set the image target directory here
$target = "itemImages/";
$target = $target . basename($_FILES["image"]["name"]);

// Variables get POSTed here - just tack new ones on at the end.
// Various POSTs omitted for brevity

$pic=($_FILES["image"]["name"]);

// Places the picture in the folder
if(move_uploaded_file($_FILES["image"]['tmp_name'], "itemImages/")) 
{
echo "The file " . basename($_FILES['uploadedfile']["name"]) . " has been         uploaded.<br />";
}else {
    echo "There was an issue adding this item. Please try again.<br />";
}

// Writes variables to the database
mysql_query("INSERT INTO tbl_item   (itemNAME,itemDESC,itemCOST,itemHCOL,itemHSIZ,itemIMG)
VALUES ('$itemName','$itemDesc','$itemCost','$hasColor','$hasSize','$pic')");

mysql_close($con);
?>

Any help, tips, advice, insight, etc. would be very much appreciated.

is the mysql update and success message OK?

Alfred
– Alfred

2012-08-10 14:35:26 +00:00
Commented Aug 10, 2012 at 14:35 — Alfred
– Alfred, Commented Aug 10, 2012 at 14:35
do you have the right enctype on your form tag?

Cfreak
– Cfreak

2012-08-10 14:35:53 +00:00
Commented Aug 10, 2012 at 14:35 — Cfreak
– Cfreak, Commented Aug 10, 2012 at 14:35
can you show us the <form> tag?

huysentruitw
– huysentruitw

2012-08-10 14:37:26 +00:00
Commented Aug 10, 2012 at 14:37 — huysentruitw
– huysentruitw, Commented Aug 10, 2012 at 14:37

Marc B · Accepted Answer · 2012-08-10 14:37:11Z

3

move_uploaded_files requires a filename as its target. It does not blindly move to a directory, so

move_uploaded_files($_FILES..., 'somedir/somefile.txt');

works, but

move_uploaded_file($_FILES..., 'somedir/');

will not.

Plus, note that your database operation is vulnerable to SQL injection attacks. You're blindly inserting the uploaded file's remote name (['name'] via $pic), and that name is fully under the remote user's control.

answered Aug 10, 2012 at 14:37

Marc B

362k44 gold badges433 silver badges508 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

CptTritium Over a year ago

Thanks, with your help, I've gotten this working. I also appreciate your input on the SQL injection, and will be doing some research to rectify it. I wasn't too worried, since the whole thing is internal for company employees, but it's always good to use best practice.

Marc B Over a year ago

Even if it's internal use and not likely to be attacked, someone at some point WILL upload a file that has a ' or other SQL metacharacter in it and mess things up.

tadman Over a year ago

Improper escaping is a bug, and often a bug that can get you fired if there's a security breach.

psx · Accepted Answer · 2012-08-10 14:36:12Z

0

Make sure the itemImages folder has write permission by the user your web server (e.g. Apache) is running as (e.g. www-data)

answered Aug 10, 2012 at 14:36

psx

4,0486 gold badges32 silver badges59 bronze badges

Comments

Matt N. · Accepted Answer · 2012-08-10 14:42:20Z

0

make sure the .php file and the folder you are writing to have the same "owner". Or try setting permissions on the itemImages folder to 777 (This is not recommended, just a debug tactic)

answered Aug 10, 2012 at 14:42

Matt N.

11 bronze badge

Collectives™ on Stack Overflow

PHP Script is not Properly Uploading Images

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related