检查PHP表单上的上载文件扩展名

I'm have a PHP contact for that checks for errors in a submission. At one part, I check the file upload for specific extensions. If the extensions isn't allowed (i.e. PHP file), then the form should produce an error message (and NOT upload the file). All of my other error message work, except this one. Please take a look at the code below and let me know if you see the problem (cause I can't see what is wrong)

我有一个PHP联系人,用于检查提交中的错误。在一个部分,我检查文件上传的特定扩展名。如果不允许扩展(即PHP文件),那么表单应该产生错误消息(并且不上传文件)。除了这一个,我的所有其他错误消息都有效。请查看下面的代码,如果您发现问题,请告诉我(因为我看不出有什么问题)

// *** FILE UPLOAD INFO *** //
//Get the uploaded file information
$name_of_uploaded_file =
    basename($_FILES['uploaded_file']['name']);
//get the file extension of the file
$type_of_uploaded_file =
    substr($name_of_uploaded_file,
    strrpos($name_of_uploaded_file, '.') + 1);
$size_of_uploaded_file =
    $_FILES["uploaded_file"]["size"]/1024;//size in KBs

//FILE UPLOAD
        //Settings
        $max_allowed_file_size = 5000; // size in KB
        $allowed_extensions = array("jpg", "jpeg", "gif", "bmp", "png", "zip", "pdf", "doc", "rtf");
        // Validations
        if($size_of_uploaded_file > $max_allowed_file_size )
        {
          $errors .= "<li>Size of file should be less than $max_allowed_file_size </li>";
        }
        //------ Validate the file extension -----
        $allowed_ext = 0;
        for($i=0; $i<sizeof($allowed_extensions); $i++)
        {
          if(strcasecmp($allowed_extensions[$i],$type_of_uploaded_file) == 0)
          {
            $allowed_ext = 1;
          }
        }

        if($allowed_ext==1)
        {
          $errors .= "<li>The uploaded file is not supported file type</li>";
          // " Only the following file types are supported: ".implode(',',$allowed_extensions);
        }

       // Check for Errors
       if(strlen($error_message) > 0) { // Check length of error message
          $errors=1; // There are Errors
       }    

3 个解决方案

#1

You have inverted the conditional so that, if your if syntax is correct, it will give you the contrast result. i.e if it is a php file will be uploaded, but jpg will be not. So I prefer to make $allowed_ext a Boolean value. i.e true or false, the way of setting it as 0 or 1 may cause confusion and need may need other operators.

您已将条件反转,因此,如果您的if语法正确,它将为您提供对比结果。即如果它是一个PHP文件将被上传,但jpg将不会。所以我更喜欢将$ allowed_ext设为布尔值。即真或假,将其设置为0或1的方式可能会引起混淆,需要其他操作员。

$allowed_ext = false;
        for($i=0; $i<sizeof($allowed_extensions); $i++)
        {
          if(strcasecmp($allowed_extensions[$i],$type_of_uploaded_file) == 0)
          {
            $allowed_ext = true;
          }
        }

        if(!$allowed_ext)
        {
          $errors .= "<li>The uploaded file is not supported file type</li>";
          // " Only the following file types are supported: ".implode(',',$allowed_extensions);
        }....

#2

Simply use in_array(), replace your code with new one

// your code to be replaced    
//------ Validate the file extension -----

    $allowed_ext = 0;
    for($i=0; $i<sizeof($allowed_extensions); $i++)
    {
      if(strcasecmp($allowed_extensions[$i],$type_of_uploaded_file) == 0)
      {
        $allowed_ext = 1;
      }
    }

    if($allowed_ext==1)
    {
      $errors .= "<li>The uploaded file is not supported file type</li>";
      // " Only the following file types are supported: ".implode(',',$allowed_extensions);
    }


// new code
//------  Validate the file extension -----

if(!in_array($type_of_uploaded_file,$allowed_extensions))
{
    $errors .= "<li>The uploaded file is not supported file type</li>";         
}

#3

Got the answer. The .errors variable was conflicting with another one earlier in the form. So, it was not validating the error. Got it working. Thanks!

得到了答案。 .errors变量与之前表单中的另一个变量冲突。所以,它没有验证错误。搞定了。谢谢!