php无法阻止大文件上传答案

【问题标题】：php fails to prevent large file uploadphp无法阻止大文件上传
【发布时间】：2013-05-06 12:43:27
【问题描述】：

为什么下面的代码会回显“您的文件已成功加载。”当我尝试上传一个 20mb 的 .gif 文件时，它实际上 a) 应该被阻止，而 b) 实际上并没有被上传？基本上，我正在尝试使用 php.ini 限制文件上传类型和大小。第一页有一个表单，最多可提交 10 张照片。

<?php
ini_set('display_errors', 'On');
error_reporting(E_ALL);

$namebase = $_POST['projectID'].'_';

$ProjID = $_POST['projectID'];

$counter = 0;

function reArrayFiles(&$file_post) {

    $file_ary = array();
    $file_count = count($file_post['name']);
    $file_keys = array_keys($file_post);

    for ($i=0; $i<$file_count; $i++) {
        foreach ($file_keys as $key) {
            $file_ary[$i][$key] = $file_post[$key][$i];
        }
    }

    return $file_ary;
}
if ($_FILES['userfile']) {
    $file_ary = reArrayFiles($_FILES['userfile']);

foreach ($file_ary as $file) {
    $counter = $counter + 1;
        print 'File Name: ' . $file['name'];
        print 'File Type: ' . $file['type'];
        print 'File Size: ' . $file['size'];


    if (empty($file['name'])) {
        break;    /* You could also write 'break 1;' here. */
    }

    $url_base="";
    $max_filesize = 1048576; // Maximum filesize in BYTES (currently 1MB).
    $upload_path = '../dev/images/uploaded/'; // The place the files will be uploaded to (currently a 'files' directory).
    $allowed_filetypes = array('.jpg','.JPG'); // These will be the types of file that will pass the validation.
    $ext = substr($file['name'], strpos($file['name'],'.'), strlen($file['name'])-1);// Get the extension from the filename.  
    $a='photo'.$counter;
    ${$a} = 'http:xxxxxxxxx'.$namebase.$counter.$ext;

    if(!in_array($ext,$allowed_filetypes))
    die('The file type of '.$file['name'].' you attempted to upload is not allowed. <INPUT TYPE="button" VALUE="Back" onClick="history.go(-1);">'); 
    // Now check the filesize, if it is too large then DIE and inform the user.


   if(filesize($file['tmp_name']) > $max_filesize)
      die($file['name'].' you attempted to upload is too large.<INPUT TYPE="button" VALUE="Back" onClick="history.go(-1);">');

   // Check if we can upload to the specified path, if not DIE and inform the user.
   if(!is_writable($upload_path))
      die('You cannot upload to the specified directory, please CHMOD it to 777.<INPUT TYPE="button" VALUE="Back" onClick="history.go(-1);">');

   // Upload the file to your specified path. can rename here.move_uploaded_file(original file name, destination path and filename)
 if(move_uploaded_file($file['tmp_name'],$upload_path.$namebase.$counter.$ext)){
      echo   '<b> '.$file['name'].'</b>'.' Accepted.  Renamed '.'<b>'.$namebase.$counter.$ext.'</b>'.'<br>';
          // It worked.
 }

      else
         die('There was an error during the file upload.  Please try again.'); // It failed :(.


    }
}

echo 'Your files have been successfully loaded.<br>'; 

?>

【问题讨论】：

我应该补充一点，2mb jpg 或其他文件类型会产生正确的消息（即“.$file['name'].'的文件类型。”您尝试上传是不允许的或$file['name'].' 您尝试上传的文件太大。

标签： php upload document

【解决方案1】：

您的if ($_FILES['userfile']) 可能是假的，所以它直接转到文件末尾；）

【讨论】：

【解决方案2】：

打印出 $_FILES 数组

print_r($_FILES)

如果它为空，那么您将收到成功消息。

【讨论】：