Member Avatar for Sophia_1

Hi everyone, i wanted to upload an excel file in a form and then display/edit the file from the form. Currently, the file can be uploaded at localhost but when i try to upload in server it was not successful. I would also want to view/edit the file and save the changes. Appreciate for your advise. Thanks a lot.

form.html

<form enctype="multipart/form-data" action="upload.php" method="POST"> 
    Please choose a file: <input name="uploaded" type="file" /><br /> <input type="submit" value="Upload" /> 
</form>

upload.php

<?php

$con=mysqli_connect("localhost","user","","pq");
// Check connection
if (mysqli_connect_errno()) 

    {
  echo "Failed to connect to MySQL: " . mysqli_connect_error();

    }

$uploaded_size ='';
$uploaded_type = "";
$uploaded = "" ;
 $target = "upload/";  $target = $target . basename( $_FILES['uploaded']['name']) ;  $ok=1;   
 //This is the sizing condition
   if ($uploaded_size > 350000)  

   {  echo "Your file is too large.<br>";  $ok=0;  }  
//This is the file type limit condition
    if ($uploaded_type =="text/php")  {  echo "No PHP files<br>";  $ok=0;  }

      if ($uploaded_type =="text/css")  {  echo "No CSS files<br>";  $ok=0;  }

         if ($uploaded_type =="text/javascript")  {  echo "No Javascript files<br>";  $ok=0;  }

            if ($ok==0)  {  Echo "Sorry your file was not uploaded";  }

          else  {  
          if(move_uploaded_file($_FILES['uploaded']['tmp_name'], $target))  
          {  echo "The file ". basename( $_FILES['uploaded']['name']). " has been uploaded";  }  
          else  
          {  echo "Sorry, there was a problem uploading your file.";  
          } 
          }
?>
Edited by pritaeas because: Fixed markdown.
  • 3 Contributors
  • 2 Replies
  • 594 Views
  • 13 Hours Discussion Span
  • Latest Post Latest Post by Taywin

Dani AI

Generated

— when an upload works on localhost but not on the server, the usual causes are a bad destination path, directory permissions/ownership, PHP limits, or server security (SELinux / open_basedir). was right to push for an absolute server path and a whitelist for allowed file types; is also right that your size variable must come from $_FILES and you must check $_FILES['...']['error'] instead of trusting client data or echoing raw errors to the browser.

A quick, practical server-side pattern to validate and move an uploaded Excel/CSV safely:

if (empty($_FILES['uploaded']) || $_FILES['uploaded']['error'] !== UPLOAD_ERR_OK) {
    error_log('Upload error: ' . ($_FILES['uploaded']['error'] ?? 'none'));
    exit('Upload failed.');
}

$size = (int) $_FILES['uploaded']['size'];
$finfo = finfo_open(FILEINFO_MIME_TYPE);
$mime = finfo_file($finfo, $_FILES['uploaded']['tmp_name']);
finfo_close($finfo);

$allowed = [
  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
  'application/vnd.ms-excel',
  'text/csv'
];

$dest = __DIR__ . '/upload';
if ($size > 5*1024*1024 || !in_array($mime, $allowed, true) || !is_dir($dest) || !is_writable($dest)) {
    error_log('Bad upload attempt or target dir not writable');
    exit('Invalid file or server error.');
}

$store = $dest . '/' . uniqid('xls_', true) . '.' . pathinfo($_FILES['uploaded']['name'], PATHINFO_EXTENSION);
if (!move_uploaded_file($_FILES['uploaded']['tmp_name'], $store)) {
    error_log('move_uploaded_file failed for ' . $store);
    exit('Server error.');
}

Also check php.ini settings (upload_max_filesize, post_max_size, file_uploads, upload_tmp_dir), server error logs, and directory ownership (set owner to the webserver user and avoid 0777; use 750/755 as appropriate). On SELinux-enabled systems ensure the upload directory has the correct context.

For viewing/editing Excel on the server, use a maintained library (PHPOffice/PhpSpreadsheet is the modern choice, not the old PHPExcel). Load the saved file from your upload folder, modify via the library API, and write a new file (or overwrite after a backup). Keep a strict whitelist and always re-check MIME/size before saving.

Recommended Answers

All 2 Replies

Member Avatar for cereal

Hi, change:

$target = "upload/";

To:

$target = $_SERVER['DOCUMENT_ROOT'] . "/upload/";

Otherwise move_uploaded_file() will try to write the destination relatively to the script path. Then it should work.

A note: the conditional statements that you're using to detect Javascript, CSS and PHP will mostly fail, as the browser will probably set their mime to text/plain.

I don't see where you set the $uploaded_type variable but I suppose you're using $_FILES['uploaded']['type'], this is not defined by PHP, since is set by the browser it can be altered by the uploader, tricking your statements.

You're using a blacklist approach. In this case you should use a whitelist approach: check only for the allowed types, i.e. the excel mime types:

I would also want to view/edit the file and save the changes.

Have you tried

Member Avatar for Taywin

I would actually stop at line 17 first. You declared value for $uploaded_size variable to an empty string, and then compared the value with an int? It means your variable is equal to 0 by default... You need to assign the real size of the supposed to be uploaded first (line 12), or it will fail right there.

Also, if $_FILES['...'] is not set, your script will fail...

Another point, if this is just an assignment, you don't need to worry about it. However, if you are doing this for your job, you should NEVER display any error from the server side on to client display! You should push the message into your log file and display other friendly error message back to the client instead!

Edited by Taywin
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.