Member Avatar for rajeesh_rsn

Hi I am new to php,
I had a form in my page to upload image and some data. And that image filed is not mandatory. I had done that script well and working well. But the problem is it always need a image ( that is not mandatory in my case ). The following is the code with me.. Kindly let me know which change i need to do for making that file field is not mandatory ...

$string = md5(microtime() * mktime());
$new = substr($type,0,1);
$ido = substr($string,0,6);
$id= $new.$ido;


$directory_self = str_replace(basename($_SERVER['PHP_SELF']), '', $_SERVER['PHP_SELF']);

// make a note of the directory that will recieve the uploaded files
$uploadsDirectory = $_SERVER['DOCUMENT_ROOT'] . $directory_self . "shopping/";

// make a note of the location of the upload form in case we need it
$uploadForm = 'http://' . $_SERVER['HTTP_HOST'] . $directory_self . 'shopping.php';

// make a note of the location of the success page
$uploadSuccess ='shopping.php';

// name of the fieldname used for the file in the HTML form
$fieldname = 'file';


$errors = array(1 => 'php.ini max file size exceeded',
                2 => 'html form max file size exceeded',
                3 => 'file upload was only partial',
                4 => 'no file was attached');

// check the upload form was actually submitted else print form
isset($_POST['Submit'])
	or error('the upload form is neaded', $uploadForm);

// check for standard uploading errors
($_FILES[$fieldname]['error'] == 0)
	or error($errors[$_FILES[$fieldname]['error']], $uploadForm);
	
// check that the file we are working on really was an HTTP upload
@is_uploaded_file($_FILES[$fieldname]['tmp_name'])
	or error('not an HTTP upload', $uploadForm);
	
// validation... since this is an image upload script we 
// should run a check to make sure the upload is an image
@getimagesize($_FILES[$fieldname]['tmp_name'])
	or error('only image uploads are allowed', $uploadForm);
	
// make a unique filename for the uploaded file and check it is 
// not taken... if it is keep trying until we find a vacant one
$md5 = md5(microtime() * mktime());


$string = substr($md5,0,5);

while(file_exists($uploadFilename = $uploadsDirectory.$string.'-'.$_FILES[$fieldname]['name']))
{
	$string++;
}
$name = $string.'-'.$_FILES[$fieldname]['name'];


// now let's move the file to its final and allocate it with the new filename
@move_uploaded_file($_FILES[$fieldname]['tmp_name'], $uploadFilename)
	or error('receiving directory insuffiecient permission', $uploadForm);
	
rename("shopping/" . $name, "shopping/" .$type."-".$name);


function error($error, $location, $seconds = 5)
{
header("Refresh: $seconds; URL=\"$location\"");
	echo '<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"'."\n".
	'"http://www.w3.org/TR/html4/strict.dtd">'."\n\n".
	'<html lang="en">'."\n".
	'	<head>'."\n".
	'		<meta http-equiv="content-type" content="text/html; charset=iso-8859-1">'."\n\n".
	'		<link rel="stylesheet" type="text/css" href="stylesheet.css">'."\n\n".
	'	<title>Upload error</title>'."\n\n".
	'	</head>'."\n\n".
	'	<body>'."\n\n".
	'	<div id="Upload">'."\n\n".
	'		<h1>Upload failure</h1>'."\n\n".
	'		<p>An error has occured: '."\n\n".
	'		<span class="red">' . $error . '...</span>'."\n\n".
	'	 	The upload form is reloading</p>'."\n\n".
	'	 </div>'."\n\n".
	'</html>';
	exit;
}

Thanks in Advance

  • 2 Contributors
  • 2 Replies
  • 245 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by wilch

Dani AI

Generated

Short summary: the script fails when no file is sent because the image-validation and move steps run unconditionally. is correct that image handling should be wrapped in a conditional, but relying on the posted filename alone is fragile. A safer pattern is to test the upload error code (UPLOAD_ERR_NO_FILE) and only run image checks when a real upload exists.

Example pattern (check first, then validate and move):

if (!isset($_FILES['file']) || $_FILES['file']['error'] === UPLOAD_ERR_NO_FILE) {
    // no image supplied: record no filename (or use a default)
    $name = null;
} else {
    if ($_FILES['file']['error'] !== UPLOAD_ERR_OK) { error('Upload error', $uploadForm); }
    if (!is_uploaded_file($_FILES['file']['tmp_name'])) { error('Not an HTTP upload', $uploadForm); }

    $info = getimagesize($_FILES['file']['tmp_name']);
    if ($info === false) { error('Invalid image', $uploadForm); }

    $ext = image_type_to_extension($info[2], false);
    $safeName = preg_replace('/[^A-Za-z0-9._-]/', '', $type) . '-' . uniqid() . '.' . $ext;

    if (!move_uploaded_file($_FILES['file']['tmp_name'], $uploadsDirectory . $safeName)) {
        error('Failed to save uploaded file', $uploadForm);
    }
    $name = $safeName;
}

Additional practical notes and troubleshooting:

  • The HTML form must use method="post" and enctype="multipart/form-data".
  • Verify upload_max_filesize and post_max_size in php.ini and use $_FILES['file']['size'] limits.
  • Check that $uploadsDirectory exists and is writable (is_dir/is_writable), prefer building paths with __DIR__ or realpath() instead of concatenating PHP_SELF.
  • Avoid the @ error-suppression operator while debugging; log failures instead.
  • Sanitize and validate $type (it appears in the rename step) before using it in filenames to prevent path issues.
  • When no file is uploaded, set the stored filename to null or a placeholder instead of running image checks.

This preserves 's approach while adding robust error checks, secure naming, and server-side safeguards so the file field can be truly optional.

Recommended Answers

All 2 Replies

Member Avatar for rajeesh_rsn

Please help me....

Member Avatar for wilch

What i would first attempt to do is to check whether the field 'file' has anything after being posted, if it is set to something (hopefully a filename) then we can proceed to call the other image processing stuff.
Otherwise we omit the image processing code.

i.e.

//put the isset(...) stuff here

if ($_FILES['file']['name'] != '') {    //can check for other things

// check for standard uploading errors
($_FILES[$fieldname]['error'] == 0)
	or error($errors[$_FILES[$fieldname]['error']], $uploadForm);
	
// check that the file we are working on really was an HTTP upload
@is_uploaded_file($_FILES[$fieldname]['tmp_name'])
	or error('not an HTTP upload', $uploadForm);
	
// validation... since this is an image upload script we 
// should run a check to make sure the upload is an image
@getimagesize($_FILES[$fieldname]['tmp_name'])
	or error('only image uploads are allowed', $uploadForm);
	
// make a unique filename for the uploaded file and check it is 
// not taken... if it is keep trying until we find a vacant one
$md5 = md5(microtime() * mktime());


$string = substr($md5,0,5);

while(file_exists($uploadFilename = $uploadsDirectory.$string.'-'.$_FILES[$fieldname]['name']))
{
	$string++;
}
$name = $string.'-'.$_FILES[$fieldname]['name'];


// now let's move the file to its final and allocate it with the new filename
@move_uploaded_file($_FILES[$fieldname]['tmp_name'], $uploadFilename)
	or error('receiving directory insuffiecient permission', $uploadForm);
	
rename("shopping/" . $name, "shopping/" .$type."-".$name);

}
//put that function error function here
//----------------

I have put the code which i think affects the image into the if clause. All code before and after should remain as before.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.