php file upload problem

Question

This code works properly in my localhost. I am using xampp 1.7.3. but when I put it in the live server it shows Possible file upload attack!. 'upload/' is the folder under 'public_html' folder on the server. I can upload files via other script in that directory.

<?php

$uploaddir = '/upload/';//I used C:/xampp/htdocs/upload/ in localhost. is it correct here?
$uploadfile = $uploaddir . basename($_FILES['file_0']['name']);

echo '<pre>';
if (move_uploaded_file($_FILES['file_0']['tmp_name'], $uploadfile)) {
    echo "File is valid, and was successfully uploaded.\\n";
} else {
    echo "Possible file upload attack!\\n";
}

echo 'Here is some more debugging info:';
print_r($_FILES);

print "</pre>";

?>

And first, you should check if $_FILES['file_0'] exists, because it will report "Possible file upload attack" if no file at all is uploaded, which is funny. — Capsule
– Capsule, Commented Feb 28, 2011 at 21:11

Ben · Accepted Answer · 2015-01-12 16:35:07Z

4

You probably can't move your file to /upload/ which is an "upload" folder at the root of the server file system, hence move_uploaded_file() reporting FALSE and your message. Plus, this /upload/ folder probably doesn't even exist nor is it writeable.

You probably want to move it to $_SERVER['DOCUMENT_ROOT'].'/upload/' which will point to your virtual host root (something like www or wherever you're uploading your application files). Don't forget to create this folder and to change its permissions accordingly (CHMOD 777 is a good idea).

edited Jan 12, 2015 at 16:35

Ben

10.1k5 gold badges43 silver badges42 bronze badges

answered Feb 28, 2011 at 21:01

Capsule

6,1531 gold badge24 silver badges28 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

ruben Over a year ago

I just noticed this and after that saw all these answers. Thanks!

funwhilelost · Accepted Answer · 2011-02-28 21:02:05Z

2

The problem is the leading slash in your file name. While it might resolve correctly on your XAMPP machine when it's on your server box the leading slash will try to put it in the filesystem root.

It's guessing that it's an attack because people can sometimes fudge incoming parameters to drop harmful files where they can execute them!

answered Feb 28, 2011 at 21:02

funwhilelost

2,01018 silver badges20 bronze badges

Comments

Ailef · Accepted Answer · 2011-02-28 21:02:23Z

1

Most likely the $uploaddir is wrong. Use

echo dirname(__FILE__);

to get the real full path to your root folder on the web server and then put something like

/web/real/path/to/root/upload

as the path.

answered Feb 28, 2011 at 21:02

Ailef

7,92612 gold badges43 silver badges57 bronze badges

1 Comment

Capsule Over a year ago

or just __DIR__ if using PHP 5.3 ;-)

Jakub · Accepted Answer · 2011-02-28 21:06:49Z

0

Why not just do this:

$uploaddir = './upload';

it will be relative to where your script is, it that is the intent? Otherwise you need the full dir (from system root)

answered Feb 28, 2011 at 21:06

Jakub

20.5k8 gold badges67 silver badges93 bronze badges

Comments

karmicdice · Accepted Answer · 2013-04-12 12:58:30Z

Try this code

 $fltype=$_FILES['userfile']['type']; 
    echo $fltype."<br>";
    /*if($_FILES['userfile']['type'] != "image/gif") {
    echo "Sorry, we only allow uploading GIF images";
    exit;
    }*/

$uploaddir = 'uploads/';
$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);
$imgname=basename($_FILES['userfile']['name']);
$desc=$_POST["desc"];
echo "<br>".$imgname."<br>";
if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) {
    echo "File is valid, and was successfully uploaded.\n";
} else {
    echo "File uploading failed.\n";
}
$con=mysql_connect("localhost","root","");
$select=mysql_select_db("n1",$con);
$sql="insert into tblimage (imagename,description) values('$imgname','$desc')";
echo "<br>".$sql;
$rs=mysql_query($sql);
if($rs)
{
    echo "<br>Record inserted in table.<br>";
}
else
{
echo "<br>Error in table insersion.<br>";
}
echo "<br><br>uploaded image is::::<br><br>";
echo "<img src='$uploadfile' />";
?>

user2961506 · Accepted Answer · 2014-02-12 00:49:52Z

0

I had the same problem, uploading script worked on localhost but got Possible File Attack Error! on host server.

I fixed it by giving 777 permission to upload folder. Goto ftp and right click on folder and choose properties. Tick all boxes (read/write/execute) and grant 777 permission.

Also edit php.ini file usually in etc/ folder on linux. Change the following settings to

upload_max_filesize : 1024M post_max_size : 1024M max_execution_time : 6000 max_input_time : 6000 memory_limit : 128M

You can download putty to access linux server using SSH terminal.

GOOD LUCK

answered Feb 12, 2014 at 0:49

user2961506

112 bronze badges

1 Comment

Jared Dunham Over a year ago

777 has some security flaws, try using 767 first -- it's a bit more secure.

Collectives™ on Stack Overflow

php file upload problem

6 Answers 6

1 Comment

Comments

1 Comment

Comments

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

6 Answers 6

1 Comment

Comments

1 Comment

Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest