Search code examples
phpimageimage-uploadis-uploaded-file

Multiple File upload isn't working, nor is is_upload_file


I cant seem to get this thing to work right, I will think I have it and something else wont work. Take a look...

I am trying to upload multiple files, here is my php, as it sits it always says there is a problem with the file, and if I remove is_uploaded_file, it just doesn't work either.

include('image.php');
$image = new SimpleImage();

foreach(array_keys($_FILES['ref']['name']) as $i) { 

    if (is_uploaded_file($_FILES['ref']['name'][$i])) {
        $time = date("fYhis");
        $destination="./../img/treatments/" .$pageid. "/refimgs";
        $tdestination="./../img/treatments/" .$pageid. "/refimgs/thumbs";
        $image->load($_FILES['ref']['name'][$i]);
        $image->save($destination . '/' .$time . $i . '.jpg');    
        $image->resizeToWidth(140); 
        $image->save($tdestination . '/' .$time . $i . '.jpg');

    }else{ echo "Possible file upload attack: ";
        echo "filename '". $_FILES['ref']['name'][$i] . "'.";
    }
}

Solution

  • You have to use $_FILES['ref']['tmp_name'] in is_uploaded_file function. Updated code line would look like :

    include('image.php');
    $image = new SimpleImage();
    foreach(array_keys($_FILES['ref']['name']) as $i) { 
    
        if (is_uploaded_file($_FILES['ref']['tmp_name'][$i])) {
            $time = date("fYhis");
            $destination="./../img/treatments/" .$pageid. "/refimgs";
            $tdestination="./../img/treatments/" .$pageid. "/refimgs/thumbs";
            $image->load($_FILES['ref']['name'][$i]);
            $image->save($destination . '/' .$time . $i . '.jpg');      
            $image->resizeToWidth(140);   
            $image->save($tdestination . '/' .$time . $i . '.jpg');
    
       }else{ echo "Possible file upload attack: ";
           echo "filename '". $_FILES['ref']['name'][$i] . "'.";
       }
    }
    

    Note: name of the file in client machine is not valid at the server and you have to use tmp_name instead. Hope this would help you to sort out the problem.