Member Avatar for Member #910227

Warning: copy() [function.copy]: open_basedir restriction in effect. File() is not within the allowed path(s): (/home/oeaivcom:/usr/lib/php:/usr/local/lib/php:/tmp)

I am trying to create a form that someone can submit a file to an ftp location. I found a script online and it is giving me this error. Could anyone point me in the right direction? I have set the permission code of user_submissions to 777. /public_html is inside /home/oeaiv

FORM

<form id="form1" name="form1" method="post" action="enter_check.php">
<input name="ufile[]" type="file" id="ufile[]" size="25" />
</form>

ENTER_CHECK.PHP

<?php

include("db_config.php");

$tbl_name="usernames";

$path1= "public_html/fsg/user_submissions".$HTTP_POST_FILES['ufile']['name'];

if($ufile !=none)
{
if(copy($HTTP_POST_FILES['ufile']['tmp_name'], $path))
{
echo "Successful<BR/>";
echo "File Name :".$HTTP_POST_FILES['ufile']['name']."<BR/>"; 
echo "File Size :".$HTTP_POST_FILES['ufile']['size']."<BR/>"; 
echo "File Type :".$HTTP_POST_FILES['ufile']['type']."<BR/>"; 
echo "<img src=\"$path\" width=\"150\" height=\"150\">";
}
else
{
echo "Error";
}
}
?>
Edited by Member #910227 because: n/a
  • 2 Contributors
  • 1 Reply
  • 605 Views
  • 10 Hours Discussion Span
  • Latest Post Latest Post by Insensus

Dani AI

Generated

— the fix pointed out (the $path1 vs $path variable-name mismatch) is correct, but that alone won't stop the "open_basedir restriction" error. The warning means PHP refuses to access the destination because the script is trying to read or write a path that is not inside the directories allowed by the server's open_basedir setting (the error lists those allowed paths).

open_basedir is enforced by PHP configuration and restricts filesystem access to specific folders. Confirm the allowed list with phpinfo() or ini_get('open_basedir'), and confirm the actual absolute filesystem path to the public_html folder (small differences like /home/oeaiv vs /home/oeaivcom matter). Either put the upload destination inside one of the allowed directories, or ask the host to add the desired folder to open_basedir — many shared hosts require their intervention.

Recommended changes and best practice (summary):

  • Use an absolute path that is inside the allowed open_basedir roots.
  • Use the modern $_FILES superglobal and move_uploaded_file() instead of copy() for uploaded files.
  • Ensure the HTML form includes enctype="multipart/form-data".
  • Check $_FILES['ufile']['error'], use is_uploaded_file() and sanitize basename() of the filename.
  • Avoid 777; prefer ownership and 755 where possible.

Example of a minimal, safe server-side move (illustrative):

$destDir = '/home/oeaivcom/public_html/fsg/user_submissions/';
if (isset($_FILES['ufile']) && $_FILES['ufile']['error'] === UPLOAD_ERR_OK) {
    $name = basename($_FILES['ufile']['name']);
    $tmp  = $_FILES['ufile']['tmp_name'];
    if (is_uploaded_file($tmp) && move_uploaded_file($tmp, $destDir . $name)) {
        // success
    }
}

If modifying open_basedir isn't possible on the host, use a destination already listed (often /tmp) and then transfer the file (FTP or other) to the final location, or ask hosting support to adjust the PHP configuration. Also validate file types and lengths to avoid security risks.

Member Avatar for Insensus

At line 7 you specify the variable $path1 but in the copy function on line 11 you use $path which is undefined.
This produces the error.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.