I'm not scared I just wanted a REALLY minimal implementation and frankly in most upload scripts the space wasted could feed a small village in Africa. Thanks for the tips though.
Here is a better version. It's commented and produces valid HTML. It also uses move_uploaded_file and is_uploaded_file.
<?php
$maxsize = 1048576; /* The maximum file size allowed */
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<title>PHP TinyUpload</title>
</head>
<body>
<form action="" method="post" enctype="multipart/form-data">
Image:<input type="file" name="userfile">
<input type="submit" value = "Upload!"/>
<input type="hidden" name="MAX_FILE_SIZE" value="<?php echo $maxsize;?>">
<!-- MAX_FILE_SIZE is NOT safe, so you should always have a
server-side size limit. However, if you only have a server-side
limit, it will only tell the user their file is too big AFTER
they've uploaded it. This variable will be read by the browser
and calculated BEFORE the file is uploaded. -->
</form>
<br/>
<?php
if(isset($_FILES["userfile"])) /* If we received a file, process it */
{
if($_FILES["userfile"]["size"]>$maxsize)
{
echo "Your file is too big!";
} else {
if(substr($_FILES["userfile"]["type"],0,5) != "image") {
echo "Your file isn't an image!";
} else {
if(is_uploaded_file($_FILES["userfile"]["tmp_name"])
/* Here we check whether the file is uploaded or not */
&& move_uploaded_file($_FILES["userfile"]["tmp_name"],$_FILES["userfile"]["name"])) {
/* Here we actually upload the file */
echo "File ".$_FILES["userfile"]["name"]." uploaded!\n";
} else {
echo "Couldn't upload ".$_FILES["userfile"]["name"]."!\n";
}
}
}
</body>
</html>
The cleaner you write your code, the more helpful it is for beginners.
And use move_uploaded_file() instead of copy()... Additionally you could use is_uploaded_file() for even more security.
<?php
$maxsize = 1048576; /* The maximum file size allowed */
?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html lang="en">
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
<title>PHP TinyUpload</title>
</head>
<body>
<form action="" method="post" enctype="multipart/form-data">
Image:<input type="file" name="userfile">
<input type="submit" value = "Upload!"/>
<input type="hidden" name="MAX_FILE_SIZE" value="<?php echo $maxsize;?>">
<!-- MAX_FILE_SIZE is NOT safe, so you should always have a
server-side size limit. However, if you only have a server-side
limit, it will only tell the user their file is too big AFTER
they've uploaded it. This variable will be read by the browser
and calculated BEFORE the file is uploaded. -->
</form>
<br/>
<?php
if(isset($_FILES["userfile"])) /* If we received a file, process it */
{
if($_FILES["userfile"]["size"]>$maxsize)
{
echo "Your file is too big!";
} else {
if(substr($_FILES["userfile"]["type"],0,5) != "image") {
echo "Your file isn't an image!";
} else {
if(is_uploaded_file($_FILES["userfile"]["tmp_name"])
/* Here we check whether the file is uploaded or not */
&& move_uploaded_file($_FILES["userfile"]["tmp_name"],$_FILES["userfile"]["name"])) {
/* Here we actually upload the file */
echo "File ".$_FILES["userfile"]["name"]." uploaded!\n";
} else {
echo "Couldn't upload ".$_FILES["userfile"]["name"]."!\n";
}
}
}
</body>
</html>