PHP upload to specific folder

Question

I am trying to do a php upload that will upload into a specific folder. One would choose the file they wish to upload next to a dropdown box which is a folder list. This is because it organises files.

<?php 
session_start();
if(!isset($_SESSION["USER"]["Admin"])){
    header("Location: index.html?unath");
}

$folder = mysql_real_escape_string($_POST['loc']);

$target_path = "../../shared/docs/$folder";




$upload2 = $target_path  .  basename( $_FILES['uploadedfile']['name']); 

if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $upload2)) {
    echo "The file ".  basename( $_FILES['uploadedfile']['name']). 
    " has been uploaded";
} else{
    echo "There was an error uploading the file, please try again!";
}

?>

Currently the code uploads the file into the "docs" folder and not docs/folder. Instead it puts the folder name in front of the file. For example- if the folder is called "abc" and my file is called robs.docx it will upload it to the main Docs folder and call it abcrobs.docx

Ofir Baruch · Accepted Answer · 2012-08-26 11:12:46Z

2

You have a missing slash

Replace this line:

$upload2 = $target_path  .  basename( $_FILES['uploadedfile']['name']);

with:

$upload2 = $target_path  ."/".  basename( $_FILES['uploadedfile']['name']);

OR:

Replace this line:

$target_path = "../../shared/docs/$folder";

with:

$target_path = "../../shared/docs/".$folder."/";

answered Aug 26, 2012 at 11:12

Ofir Baruch

10.3k2 gold badges29 silver badges39 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Rsmithy Over a year ago

I see where I went wrong now.. noob error :) Thanks for that :D

Rsmithy Over a year ago

I will be but I have to wait until stackoverflow lets me

Community · Accepted Answer · 2017-05-23 10:27:24Z

1

You do not need mysql_real_escape_string because there's no SQL involved here.
If no database connection is established, mysql_real_escape_string returns null. So you're probably throwing away the $_POST['loc'] value.
You should never ever use user supplied values for manipulating anything on the filesystem without really, really thorough inspection of what you're going to manipulate. See Security threats with uploads.
Use var_dump liberally to see what your values look like at various stages and do some debugging.

edited May 23, 2017 at 10:27

CommunityBot

11 silver badge

answered Aug 26, 2012 at 11:14

deceze♦

525k89 gold badges806 silver badges954 bronze badges

2 Comments

Rsmithy Over a year ago

I just copied something from an old script for the $folder = mysql_real_escape_string($_POST['loc']); At the minute i'm building a rough script which I will develop; for security and duplicate file names. Thanks for the feedback and link

Rsmithy Over a year ago

This upload area is also on a restricted area- only admin users (whom I've authorised) can access- they upload the files to an area where all users on the portal can access (via a webpage)

tomsv · Accepted Answer · 2012-08-26 11:12:59Z

0

You are missing a slash after $target_path

answered Aug 26, 2012 at 11:12

tomsv

7,2878 gold badges58 silver badges90 bronze badges

2 Comments

Lix Over a year ago

This is really a comment, not an answer.

Rsmithy Over a year ago

./. In a way it does answer my question as in I have to look at my code and see where I missed the '/'

Josh · Accepted Answer · 2012-08-26 11:13:34Z

0

Add a / on the end of your $target_path:

$target_path = "../../shared/docs/$folder/";

answered Aug 26, 2012 at 11:13

Josh

2,9151 gold badge24 silver badges33 bronze badges

Comments

mewm · Accepted Answer · 2012-08-26 11:15:53Z

0

You should properly escape your variables:

$target_path = "../../shared/docs/". $folder ."/";

answered Aug 26, 2012 at 11:15

mewm

1,27710 silver badges13 bronze badges

Collectives™ on Stack Overflow

PHP upload to specific folder

5 Answers 5

2 Comments

2 Comments

2 Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

5 Answers 5

2 Comments

2 Comments

2 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related