Uploading a csv file in PHP. Where is the error in the code

Question

<?php
    require '../config.php';
   // Edit upload location here   
   $result = 0;
   $name = mysql_real_escape_string($_FILES['myfile']['name']);
   $path = csv;
   $ext = 'csv';
   $md5 = md5($name);
   $target_path = $path . '\\' . $md5 . '.' . $ext;

   if(move_uploaded_file($_FILES['myfile']['tmp_name'], $target_path)) {
      $result = 1;
   }

   sleep(1);


?>

It won't upload any files such as with the file names that contain brackets, etc.

To show error messages, use error_reporting(E_ALL);

Surreal Dreams
– Surreal Dreams

2012-12-14 23:48:59 +00:00
Commented Dec 14, 2012 at 23:48 — Surreal Dreams
– Surreal Dreams, Commented Dec 14, 2012 at 23:48

user1592648 · Accepted Answer · 2012-12-14 23:52:27Z

2

Don't do:

$name = mysql_real_escape_string($_FILES['myfile']['name']);

Do:

$name = $_FILES['myfile']['name'];

you are getting the MD5 of $name so no reason to clean it as it will produce a 32-char hex string which will not contain any special characters regardless. If a filename contains special chars and you escape using the above the MD5 will completely change.

answered Dec 14, 2012 at 23:52

user1592648

Sign up to request clarification or add additional context in comments.

Comments

Mike Brant · Accepted Answer · 2012-12-14 23:46:37Z

1

The error is likely here:

$path = csv;

Here PHP is looking for a constant with name csv unless you have defined that, it is going to return null, so your $target_path is not being built correctly.

answered Dec 14, 2012 at 23:46

Mike Brant

71.4k10 gold badges102 silver badges104 bronze badges

3 Comments

Vish Over a year ago

Hi, csv is defined to a directory with right permissions. Also, how can I get it to show any error messages. It is not even showing any error messages.

Mike Brant Over a year ago

Why are you using \` in the $target_path` definition. Check to make sure you have error_reporting and display_errors set properly to where you can see PHP errors.

Mike Brant Over a year ago

I also don't know why you are using mysql_real_escape_string here. You are not inserting the filename into mysql so I don't know what you gain from this, though I don't think it is your problem unless you don't have a database connection open in which case it will fail.

Rob · Accepted Answer · 2012-12-15 00:04:36Z

0

Just one more thing to try is use the pre defined DIRECTORY_SEPERATOR constant while building your $target path so...

$target_path = $path . DIRECTORY_SEPERATOR . $md5 . '.' . $ext;

answered Dec 15, 2012 at 0:04

Rob

2352 silver badges9 bronze badges

3 Comments

Vish Over a year ago

still not working. I am able to upload files without any special characters in the name

Rob Over a year ago

can you give me an example of one you are trying to upload that is failing?

Rob Over a year ago

What it sounds like is hapenning is you need to strip out any special characters from the file name that wouldn't be allowed when saving the file. For that, the long but safe approach is to create a function and inside that function define an array of characters that aren't allowed, then return str_replace($badchars, '', $target_path.

Collectives™ on Stack Overflow

Uploading a csv file in PHP. Where is the error in the code

3 Answers 3

Comments

3 Comments

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

3 Comments

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related