Member Avatar for DaveyMoyes

Hi All, I have the following scrip that uploads a image to a destination folder on my server.

What I am trying to do is "rename" the uploaded file and update the link in the back end database.

The file uploads and stores in the correct folder, but what it does not do, is rename the uploaded file.

Here is the script I am working on.

            ////////////////////////////////////////////////////////////////////////////////////////////////////////////
            $img1 = $_FILES['jan_image']['name'];
            //let's add a security check, to make sure only allowed files are uploaded
            $ext=explode('.',$img1);//explode the image name into an array to get the extension
            // allowed extensions, add or remove any extension you want allowed(LOWER CASE ONLY)
            $allowed_exts=array('jpg','jpeg','png','bmp','gif');
            if(in_array(strtolower($ext[1]), $allowed_exts)){//file type is allowed!

                $dest="members/$securecode/$sname/images/$id/$storeitem/".$img1;
                $val= move_uploaded_file($_FILES['jan_image']['tmp_name'], $dest);

                chmod($dest, 0644);//make sure you have permissions for the file
                if($val)
                { //update database and rename
                rename($dest, 'members/'.$securecode.'/'.$sname.'/images/'.$id.'/'.$storeitem.'/update.jpg');
                $dest="members/".$securecode."/".$sname."/images/".$id."/".$storeitem."/update.jpg";//set $dest to the new file name - database entry is correct

                mysql_query("update 3tfbs set img1 ='".$id."/".$storeitem."/$img1' where uiid='".$storeitem."'");
                }
                }

                header( "Location: members.php") ;
Edited by TrustyTony because: fixed formating
  • 2 Contributors
  • 1 Reply
  • 194 Views
  • 5 Hours Discussion Span
  • Latest Post Latest Post by cereal

Dani AI

Generated

Quick diagnosis: the file is being moved then renamed, but the database update still inserts the original filename — that mismatch is why links break. There are a few additional issues to fix: do file-type checks on the uploaded content (not just the extension), move directly to the final filename using a server filesystem path (not a URL), and stop building HTML in the DB field. Also avoid the old mysql_* API — use PDO or mysqli with prepared statements.

Recommended workflow (safe, minimal changes to your logic):

  • Validate the upload error and size, then verify actual MIME type with finfo and map it to allowed extensions (this prevents double-extension attacks).
  • Build a safe final filename (either a deterministic one if you want to overwrite, e.g. $storeitem . ".jpg", or a unique name using uniqid()).
  • Use an absolute filesystem path for directories (ensure the directory exists and is writable), move_uploaded_file directly to the final name, then chmod.
  • Update the DB with a prepared statement and store a plain path or filename (not an HTML anchor). Generate the full URL when you render pages.

Example (illustrative — adapt variable names to your code):

$upload = $_FILES['jan_image'];
$finfo = new finfo(FILEINFO_MIME_TYPE);
$mime = $finfo->file($upload['tmp_name']);

// map mime -> allowed extensions
$map = ['image/jpeg'=>['jpg','jpeg'],'image/png'=>['png'],'image/gif'=>['gif'],'image/bmp'=>['bmp']];
$ext = strtolower(pathinfo($upload['name'], PATHINFO_EXTENSION));
if (!isset($map[$mime]) || !in_array($ext, $map[$mime])) { throw new Exception('Invalid image'); }

// choose final name (overwrite or unique)
$final = $storeitem . '.' . $ext; // or $storeitem . '_' . uniqid() . '.' . $ext
$dir = $_SERVER['DOCUMENT_ROOT'] . "/members/$securecode/$sname/images/$id/$storeitem";
if (!is_dir($dir)) mkdir($dir, 0755, true);
$target = "$dir/$final";
if (!move_uploaded_file($upload['tmp_name'], $target)) { throw new Exception('Move failed'); }
chmod($target, 0644);

// update DB with prepared statement, store relative path
$relative = "members/$securecode/$sname/images/$id/$storeitem/$final";
$pdo->prepare("UPDATE `3tfbs` SET `img1` = ? WHERE `uiid` = ?")->execute([$relative, $storeitem]);

Troubleshooting: check return values (move_uploaded_file, mkdir, DB execute), enable error logging while developing, and verify directory ownership/permissions. This follows 's note about filesystem paths and fixes the filename/DB mismatch that is seeing.

Member Avatar for cereal

Use absolute paths, you can use $_SERVER['DOCUMENT_ROOT'] . "/members/$securecode/$sname/..."

Also, if I upload a file with double extension, let's say my_image.jpg.php, it will get through the conditional statement at line 7. Bye.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.