link to file in cakephp

[asaidi]

Hi
in my form i have an option that i can attach a file to my database
and i can see the filename in my database and in my view..but i m trying to make a link on it in view that i can read it
please check my code:

***/in add i have this
echo $this->Form->input('pod',array('label'=>'Pod attachment','type'=>'file'));
**/and here i can browse to a file and attach it 
**/in the view i m trying this
<?php echo $this->Html->link($pod['Pod']['pod']); ?>
**/not working i cannot read it

any help please

[cereal]

Are you also storing the path in which the file is saved?

[asaidi]

Hi
i dont think i m storing the path

[cereal]

Ok, standing to CakePHP documentation (not sure about the version you are using) Html->link() method expects at least two parameters: title and url.

HtmlHelper::link(string $title, mixed $url = null, array $options = array(), string $confirmMessage = false)

So your code $this->Html->link($pod['Pod']['pod']) should change to something like:

$this->Html->link('Name of the File', '/path/'.$pod['Pod']['pod']);

Reference: http://book.cakephp.org/2.0/en/core-libraries/helpers/html.html#HtmlHelper::link

[asaidi]

Hi
thanks
and if i dont know the name of the file the user will upload it via type "file"

[cereal]

To strictly reply to your question you can use the physical name of the file, you get this from $_FILES array, for example:

$this->Html->link($_FILES['fieldname']['name'], '/path/'.$_FILES['fieldname']['name']);

But consider to go through these few steps before printing anything temporary, because you could allow the execution of a malicious script:

1. check if file is allowed, for example: jpg, pdf, zip
2. rename it, to avoid accidentals rewrites of existing files
3. save the file name somewhere, for example into a database

Then you can query the database to retrieve the file list and loop them to build an output. Otherwise you can scan the directory in which the files are saved. In any case you have to do at least the first two steps.

Check this for more information: https://www.owasp.org/index.php/Unrestricted_File_Upload