uploading music to mysql database

hi ..
I would like to make a music gallery for my website ..
so, is there any mysql data type that allows me to stors music on it ?
if yes what is the php statement or code that upload it to mysql?
any help will on be gratly appreciated.
Who is Participating?
Richard QuadlingConnect With a Mentor Senior Software DeveloperCommented:
Using the file upload capability of the clients browser and the uploaded file capability of PHP.

Straight from the PHP Manual ...

Example 5.1. File Upload Form
A file upload screen can be built by creating a special form which looks something like this:

copy to clipboard
<!-- The data encoding type, enctype, MUST be specified as below -->
<form enctype="multipart/form-data" action="__URL__" method="POST">
   <!-- MAX_FILE_SIZE must precede the file input field -->
   <input type="hidden" name="MAX_FILE_SIZE" value="30000" />
   <!-- Name of input element determines name in $_FILES array -->
   Send this file: <input name="userfile" type="file" />
   <input type="submit" value="Send File" />

The __URL__ in the above example should be replaced, and point to a PHP file.

The MAX_FILE_SIZE hidden field (measured in bytes) must precede the file input field, and its value is the maximum filesize accepted. This is an advisory to the browser, PHP also checks it. Fooling this setting on the browser side is quite easy, so never rely on files with a greater size being blocked by this feature. The PHP settings for maximum-size, however, cannot be fooled. This form element should always be used as it saves users the trouble of waiting for a big file being transferred only to find that it was too big and the transfer failed.

Be sure your file upload form has attribute enctype="multipart/form-data" otherwise the file upload will not work.

The global $_FILES exists as of PHP 4.1.0 (Use $HTTP_POST_FILES instead if using an earlier version). These arrays will contain all the uploaded file information.

The contents of $_FILES from the example form is as follows. Note that this assumes the use of the file upload name userfile, as used in the example script above. This can be any name.

The original name of the file on the client machine.

The mime type of the file, if the browser provided this information. An example would be "image/gif". This mime type is however not checked on the PHP side and therefore don't take its value for granted.

The size, in bytes, of the uploaded file.

The temporary filename of the file in which the uploaded file was stored on the server.

The error code associated with this file upload. This element was added in PHP 4.2.0

Files will, by default be stored in the server's default temporary directory, unless another location has been given with the upload_tmp_dir directive in php.ini. The server's default directory can be changed by setting the environment variable TMPDIR in the environment in which PHP runs. Setting it using putenv() from within a PHP script will not work. This environment variable can also be used to make sure that other operations are working on uploaded files, as well.

Example 5.2. Validating file uploads
See also the function entries for is_uploaded_file() and move_uploaded_file() for further information. The following example will process the file upload that came from a form.

copy to clipboard
// In PHP versions earlier than 4.1.0, $HTTP_POST_FILES should be used instead
// of $_FILES.

$uploaddir = '/var/www/uploads/';
$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);

echo '<pre>';
if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) {
   echo "File is valid, and was successfully uploaded.\n";
} else {
   echo "Possible file upload attack!\n";

echo 'Here is some more debugging info:';

print "</pre>";

The PHP script which receives the uploaded file should implement whatever logic is necessary for determining what should be done with the uploaded file. You can, for example, use the $_FILES['userfile']['size'] variable to throw away any files that are either too small or too big. You could use the $_FILES['userfile']['type'] variable to throw away any files that didn't match a certain type criteria, but use this only as first of a series of checks, because this value is completely under the control of the client and not checked on the PHP side. As of PHP 4.2.0, you could use $_FILES['userfile']['error'] and plan your logic according to the error codes. Whatever the logic, you should either delete the file from the temporary directory or move it elsewhere.

If no file is selected for upload in your form, PHP will return $_FILES['userfile']['size'] as 0, and $_FILES['userfile']['tmp_name'] as none.

The file will be deleted from the temporary directory at the end of the request if it has not been moved away or renamed.

Example 5.3. Uploading array of files
PHP supports HTML array feature even with files.

copy to clipboard
<form action="" method="post" enctype="multipart/form-data">
<input type="file" name="pictures[]" />
<input type="file" name="pictures[]" />
<input type="file" name="pictures[]" />
<input type="submit" value="Send" />
copy to clipboard
foreach ($_FILES["pictures"]["error"] as $key => $error) {
   if ($error == UPLOAD_ERR_OK) {
       $tmp_name = $_FILES["pictures"]["tmp_name"][$key];
       $name = $_FILES["pictures"]["name"][$key];
       move_uploaded_file($tmp_name, "data/$name");
?>User contributed notes:
(07-Apr-2006 08:28)

If you're having a problem with filenames because of magic quotes, use stripslashes() to...strip slashes.

kweechang at yahoo dot com (07-Apr-2006 08:34)

I have the same problem with filename contains single quote. Currently, I am using web-hosting services, hence I am not able to switch magic_quotes_gpc on/off.
After some study, I have discovered that the cause of the problem is in function basename();
For example:
$windows_filename = "C:\tmpdir\ling's document.doc"
with magic_quotes_gpc on
it becames
$windows_filename = "C:\\tmpdir\\ling\'s document.doc"
if you do a
 echo basename($windows_filename)
the result will be
  "s document.doc"
which is not correct, but this is exactly what we get from $_FILES['userfile']['name'];
To work around with this problem, the following solution might work.
Step 1:
a) Include a hidden field "userfilename" in your form.
b) add a javascript to the "file" input. To objective is to dupilcate the full filename and post it to the host.
<form name="imgform" method="post" action="upload.php" enctype="multipart/form-data">
  <input type="hidden" name="userfilename" id="userfilename">
  <input type="file" name="userfile" id="userfile" size="64" maxlength="256" onChange="javascript:top.document.imgform.userfilename.value= top.imgform.userfile.value">
Step 2:
a) extract the filename from the "userfilename"
       $fileName = $_FILES['userfile']['name'];
       $tmpName  = $_FILES['userfile']['tmp_name'];
       $fileSize = $_FILES['userfile']['size'];
       $fileType = $_FILES['userfile']['type'];
       $fp = fopen($tmpName, 'r');
       $content = fread($fp, $fileSize);
       $content = addslashes($content);
           $fileName = addslashes($fileName);
       } else {
$fileName = addslashes(basename(stripslashes($_POST['userfilename'])));

chaz_meister_rock at yahoo dot com (09-Mar-2006 06:09)

As mentioned in this thread by mariodivece at bytedive dot com on 24-Aug-2005 12:33:
"when using base64_encode to store binary data in a database, you are increasing the size of the data by 1.33 times."
so, if you are receiving the dreaded "MySQL Server has gone away" error when uploading BLOB data encoded w/base64, remember that your MySQL "max_allowed_packet" configuration setting (default 1MB) needs to by 1.33 times the size of your PHP "upload_max_filesize" setting.

brett dot r dot brown at gmail dot com (12-Jan-2006 11:01)

In regards to geert dot php at myrosoft dot com about having the filenames cut off if single quotes are present in the filename, I had this same problem.  The solution to this, is to set magic_quotes_gpc to off.
When magic_quotes_gpc is on, whenever a single quote is present in any _post data, a \ is inserted before any single quotes as an escape character.  This comes in handy if you're storing the post data into mySQL, but causes problems, as you've had, when receiving an upload.

jason (10-Jan-2006 01:08)

Regarding empty $_FILES and $_POST arrays when uploading files larger than post_max_size:
Tucked away in http://us3.php.net/manual/en/ini.core.php#ini.post-max-size is this nugget:
"If the size of post data is greater than post_max_size, the $_POST and $_FILES superglobals are empty. This can be tracked in various ways, e.g. by passing the $_GET variable to the script processing the data, i.e. <form action="edit.php?processed=1">, and then checking if $_GET['processed'] is set."
This may seem like a bug. You'd expect something like UPLOAD_ERR_FORM_SIZE to be set. But you just two empty superglobals.
I've seen it submitted to bugs.php.net twice and it's been marked as bogus both times.

Marcus (04-Jan-2006 03:11)

Many ppl uses a java applet for uploading files instead of a forms post. This way you can get a progress bar etc.
If you for some reason cannot upload very large files you can use the java applet to upload it in chunks. I made a small change to the free JUpload applet hosted at sourceforge to do this.
If you in the url you're posting to add the argument
the upload will be done as several posts where max-size of one part is integervalue. So you can keep track of where you are, two more parameters are added:
jupart, which is 0..
jufinal, which is 0 when there is more left or 1 if finished.
address to project:
link to this JUpload version is here:

geert dot php at myrosoft dot com (23-Dec-2005 08:16)

When file names do contain single quote parts of the filename are being lost.
eg.: uploading a filename
     startName 'middlepart' endName.txt
will be uploaded (and hence stored in the _Files ['userfile'] variable as
skipping everything before the second single quote.

pete at NOSPAMpetesmithcomputers dot com (08-Dec-2005 01:03)

I find I often have to handle photos in CMSs, so I wrote this class. It doubtless needs improvements, but it works pretty well.
class picture
       var $save_dir;                     //where file will be saved
       var $filename="spacer.gif";        //default file name initially
       var $error_message="";             //string to be output if neccesary
       var $width;                        //height of final image
       var $height;                       //width of final image
       function picture($save_directory, $file_array, $max_width, $max_height)
               $this->save_dir = $save_directory;                
               $this->width =    $max_width;
               $this->height =   $max_height;
               //--change filename to time - make it unique
               $temp_filename = $file_array['name'];
               $ext = explode('.',$temp_filename);
               $ext = $ext[count($ext)-1];
               $temp_filename = time().".".$ext;
               //--check that it's a jpeg or gif
               if (preg_match('/^(gif|jpe?g)$/',$ext)) {
                       // resize in proportion
                       list($width_orig, $height_orig) = getimagesize($file_array['tmp_name']);
                       if ($this->width && ($width_orig < $height_orig)) {
                               $this->width = ($this->height / $height_orig) * $width_orig;
                       } else {
                               $this->height = ($this->width / $width_orig) * $height_orig;
                       $image_p = imagecreatetruecolor($this->width, $this->height);                        
                       //handle gifs and jpegs separately
                           $image = imagecreatefromgif($file_array['tmp_name']);                            
                           imagecopyresampled($image_p, $image, 0, 0, 0, 0, $this->width, $this->height, $width_orig, $height_orig);
                           imagegif($image_p, $this->save_dir.$temp_filename, 80);
                           $image = imagecreatefromjpeg($file_array['tmp_name']);                            
                           imagecopyresampled($image_p, $image, 0, 0, 0, 0, $this->width, $this->height, $width_orig, $height_orig);                            
                           imagejpeg($image_p, $this->save_dir.$temp_filename, 80);
file is not a jpeg or gif picture

djot at hotmail dot com (27-Nov-2005 10:02)

Be carefull with setting max_file_size via
ini_get might return values like "2M" which will result in non working uploads.
This was the "no no" in my case:
$form = '<input type="hidden" name="MAX_FILE_SIZE" value=".ini_get('upload_max_filesize')." />';
Files were uploaded to the server, but than there was not any upload information, not even an error message. $_FILES was completly empty.

info at giel berkers dot com (10-Nov-2005 12:03)

I had problems when uploading files using Internet Explorer and Firefox. I checked for extension and mime-type to make sure it was a jpeg-file my users uploaded. Firefox did it well, only Internet Explorer failed to accept the file saying it wasn't the correct mime-type. After some testing, I discovered that Firefox reads the mime-type of a Jpeg-image as:
While Internet Explorer reads it as:
I hope this helps somebody to avoid an evening debugging. To contribute to php.net, I enclosed my secure upload script for Jpeg files:
 function storefile($var, $location, $filename=NULL, $maxfilesize=NULL) {
   $ok = false;
   // Check file
   $mime = $_FILES[$var]["type"];
   if($mime=="image/jpeg" || $mime=="image/pjpeg") {
     // Mime type is correct
     // Check extension
     $name  = $_FILES[$var]["name"];
     $array = explode(".", $name);
     $nr    = count($array);
     $ext   = $array[$nr-1];
     if($ext=="jpg" || $ext=="jpeg") {
       $ok = true;
   if(isset($maxfilesize)) {
     if($_FILES[$var]["size"] > $maxfilesize) {
       $ok = false;
   if($ok==true) {
     $tempname = $_FILES[$var]['tmp_name'];
     if(isset($filename)) {
       $uploadpath = $location.$filename;
     } else {
       $uploadpath = $location.$_FILES[$var]['name'];
     if(is_uploaded_file($_FILES[$var]['tmp_name'])) {  
      while(move_uploaded_file($tempname, $uploadpath)) {
         // Wait for the script to finish its upload    
     return true;
   } else {
     return false;
You can use this script as follow:
if(isset($_FILES['name'])) {
 if(storefile("name", $_SERVER['DOCUMENT_ROOT']."test/img")) {
   echo("Upload succeeded!");
 } else {
   echo("Upload failed...");
The last 2 parameters 'filename' and 'maxfilesize' are optional. Offcourse, you can change this script with other mime types and extensions to fit your needs.

ohdotoh at randomnoisebursts dot com (10-Oct-2005 08:33)

my quick and simple don't overwrite files that exist solution:
if (file_exists($sysfolder . '/' . $filename)) {
// append a digit to the beginning of the name
 $tmpVar = 1;
 while(file_exists($sysfolder . '/' . $tmpVar . '-' . $filename)) {
// and keep increasing it until we have a unique name
 $filename= $tmpVar . '-' . $filename;

ded at in dot ua (04-Oct-2005 10:03)

Generally, if you use
CharsetDisable on
CharsetSourceEnc off
in (russian) apache config file, and if your script which receives upload still have some html, use <meta http-equiv ...> tags so browser can correctly display the pages.

andrea at 3site dot it (21-Sep-2005 04:05)

Hello, here is an experimental PHP / AJAX method to monitoring upload status.
Thank you, PHP !!!

NO_lewis_SPAM at NOSPAM dot delta-hf dot co dot uk (03-Sep-2005 05:27)

I have been having issues with putting data in to an MSSQL database from an uploaded file. Trying to INSERT a file in excess of 25MB caused "Insufficient memory" errors from the SQL server
I decided to chunk the data into the database rather than trying to spurt it all in at once. The memory management is much better and from Submit to in the DB takes about 1 second per MB. The machine has dual Pentium 3 933MHz and 2GB RAM.
First things first I had to write a stored procedure. I saw no point in attempting to return a TEXTPTR(), which is required for the UPDATETEXT function to work, back to PHP so I didn't even bother. This is my very first stored procedure since this is really the first time I've developed solely for MSSQL. The important thing is that it's functional.
Here's the code I used for my stored procedure. After writing this I need to execute it in a loop to get all the data in, in the correct order. I leave that bit to PHP of course. Please don't tell me I could have just written it all in the stored procedure using another language, this is PHP and MSSQL we're talking about. :)
The zipfile column data type is TEXT, I tried IMAGE but it was problematic dealing with HEX data.
///////////// SP//////////////////////
CREATE PROCEDURE dbo.dds_writeBlob @dataChunk AS TEXT, @refCode AS VARCHAR(50), @offSet AS INT
SELECT @dataPtr=TEXTPTR(zipfile)
FROM [dbo].[file] (UPDLOCK)
WHERE [dbo].[file].ref = @refCode
UPDATETEXT [dbo].[file].zipfile @dataPtr @offSet 0 @dataChunk
//////////////////END SP/////////////////
Then of course comes the PHP code to do the chunking. Firstly I have to convert the binary data to a type that can be accepted by TEXT data type. base64_encode() comes in handy for this purpose but of course I need it in chunks so I used chunk_split() and split it in to chunks of 256000 bytes by declaring the optional [chunklen]. I then explode() it in to a numerically indexed array using the newlines ("\r\n") that are inserted every [chunklen] by chunk_split. I can then loop through with a for(), passing the data chunks, in order, one at a time to the stored procedure. Here's the code:
$data = chunk_split(base64_encode(fread(fopen($file, "rb"), filesize($file))), 256000);
$arrData = explode("\r\n", $data);
unset($data); // Clear memory space
$num = count($arrData);
$offset = 0;
for ($i=0;$i<$num;$i++) {
$buffer = $arrData[$i];
$query = "EXEC [dds_writeBlob] '".$buffer."', '$reference', $offset";
@mssql_query($query) or die(mssql_get_last_message());
$offset = ($offset + strlen($buffer));

Of course we then need to extract the data from the database. This, thankfully, is a lot easier! Simply base64_decode() the data before outputting to a browser.
$query = "SELECT zipfile, job_code FROM [file] WHERE ref = '$ref'";
@$result = mssql_query($query) or die('File Download: Failed to get file from the database.');
$file = mssql_fetch_assoc($result);
header('Content-type: application/zip');
header('Content-Disposition: attachment; filename="job-'.trim($file['job_code']).'.zip"');
echo base64_decode($file['zipfile']);
The benefit of storing in base64_encoded format is the simplicity with which you can now send mime emails with the data attached as an alternative to having people download it. A simple chunk_split() on the SELECTed data will have it in the right format for mime mails.
The draw back is the extra size required! Expect the base64_encoded data to be 1.33 times the size of the original data!

Dave Koopman (25-Aug-2005 03:22)

Upload progress bar by patching PHP source code.  Uses file or MySQL table to log progress.  MySQL is useful in load balanced situations.  

mariodivece at bytedive dot com (24-Aug-2005 07:33)

Just wanted to point out a detail that might be of interest to some:
when using base64_encode to store binary data in a database, you are increasing the size of the data by 1.33 times. There is a nicer way of storing the data directly. Try the following:
<?php $data = mysql_real_escape_string($data); ?>
This will leave the data untouched and formatted in the correct way and ready to be inserted right into a MySQL statement without wasting space.
By the way, I'd like to thank therebechips for his excellent advice on data chunks.

warwickbarnes at yahoo dot co dot uk (19-Aug-2005 12:58)

You may come across the following problem using PHP on Microsoft IIS: getting permission denied errors from the move_uploaded_file function even when all the folder permissions seem correct. I had to set the following to get it to work:
1. Write permissions on the the folder through the IIS management console.
2. Write permissions to IUSR_'server' in the folder's security settings.
3. Write permissions to "Domain Users" in the folder's security settings.
The third setting was required because my application itself lives in a secure folder - using authentication (either Basic or Windows Integrated) to identify the users. When the uploads happen IIS seems to be checking that these users have write access to the folder, not just whether the web server (IUSR_'server') has access.
Also, remember to set "Execute Permissions" to "None" in the IIS management console, so that people can't upload a script file and then run it. (Other checks of the uploaded file are recommended as well but 'Execute None' is a good start.)

myko AT blue needle DOT com (16-Aug-2005 05:13)

Just a quick note that there's an issue with Apache, the MAX_FILE_SIZE hidden form field, and zlib.output_compression = On.  Seems that the browser continues to post up the entire file, even though PHP throws the MAX_FILE_SIZE error properly.  Turning zlib compression to OFF seems to solve the issue.  Don't have time to dig in and see who's at fault, but wanted to save others the hassle of banging their head on this one.

muoihv at 1yt dot net (04-Aug-2005 09:47)

// Split file Submit and HTML post
function uploaderFILES($num_of_uploads=1, $file_types_array=array("JPG"), $max_file_size=1048576, $upload_dir=""){
  $max_file_size = 1048576;
 foreach($_FILES["file"]["error"] as $key => $value)
        $origfilename = $_FILES["file"]["name"][$key];
        $filename = explode(".", $_FILES["file"]["name"][$key]);
        $filenameext = $filename[count($filename)-1];
        $filename = implode(".", $filename);
        $filename = substr($filename, 0, 15).".".$filenameext;
        $file_ext_allow = FALSE;
            $file_ext_allow = TRUE;
        } // for
            if(move_uploaded_file($_FILES["file"]["tmp_name"][$key], $upload_dir.$filename)){
              echo("File uploaded successfully. - <a href='".$upload_dir.$filename."' target='_blank'>".$filename."</a><br />");
else { echo('<font color="#FF0000">'.$origfilename."</font> was not successfully uploaded - khong the upload duoc <br />");}
  else  { echo('<font color="#FF0000">'.$origfilename."</font> was too big, not uploaded - Kich thuoc file qua' lon <br />"); }
        } // if
else{ echo('<font color="#FF0000">'.$origfilename." </font>had an invalid file extension, not uploaded - File nay khong ton tai <br />");   }
  else{ echo('<font color="#FF0000">'.$origfilename." </font>was not successfully uploaded - khong the upload duoc <br />");  } // else
} // funtion
 <form action='<?=$PHP_SELF;?>' method='post' enctype='multipart/form-data'>Upload files:<br /><input type='hidden' name='submitted' value='TRUE' id='<?=time();?>' >
 <input type='hidden' name='MAX_FILE_SIZE' value='<?=$max_file_size;?>' >
<?   for($x=0;$x<$num_of_uploads;$x++){
    $form .= "<input type='file' name='file[]'><br />";
  $form .= "<input type='submit' value='Upload'><br />
  <font color='red'>*</font>Maximum file length (minus extension) is 15 characters. Anything over that will be cut to only 15 characters. Valid file type(s): ";
      $form .= $file_types_array[$x].", ";
      $form .= $file_types_array[$x].".";
uploaderFILES($num_of_uploads, $file_types_array, $max_file_size, $upload_dir);

dan at DLC2 dot com (01-Aug-2005 09:19)

Are you struggling to implement these code samples for "file upload" or "multiple file upload"? Are you still scratching your head why they don't work??
I tried everything, until I realized that my version of PHP was too old! Look at these tidbits (collected from pages at PHP.NET for your enjoyment):
Requires PHP v4.1 - The $_FILES array
Requires PHP v4.2 - The "error" sub-array - example: $_FILES["userfile"]["error"]
Requires PHP v4.3 - The constants for "error" sub-array - example: UPLOAD_ERR_OK (value 0)
So, if you have PHP v4.0.X or earlier, use the $HTTP_POST_FILES variable and just do without the error sub-array and it’s constants. It still works good!
If you found this article useful, send praise via email. If this was a life-saver, send chocolate.

hakimu @ gmail dot com (24-Jul-2005 09:06)

This is a response to bryan dot fillmer at beasleyallen dot com about renamig files to avoid ovewriting. it's simple, since the only problem is the extention, there are other ways of doing the same heres mine
// Where the file is going to be placed temporarly
$target_path = "/";
$target_path = $target_path . basename( $_FILES['uploadedfile']['name']);
$_FILES['uploadedfile']['tmp_name']; // temp file
$target_path = "upload/";
$oldfile =  basename($_FILES['uploadedfile']['name']);
// getting the extention
$pos = strpos($oldfile,".",0);
$ext = trim(substr($oldfile,$pos+1,strlen($oldfile))," ");
//new file name exmaple for a profile image of a user
$newfile = $username . "." . $ext;
// move the file to the final destination
$target_path = $target_path . basename($newfile);
if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) {
    echo "The file ". basename( $_FILES['uploadedfile']['name']). " has been uploaded";
} else{
    echo "There was an error uploading the file, please try again!";

pvollma at pcvsoftware dot net (13-Jul-2005 07:47)

Note that in Example 38-2 above, the basename() function will NOT extract the file name from an upload submitted by MS IE to a PHP program running on a *nix server! See my explanation in the notes for the basename() function.

suri @ suribala dot com (28-Jun-2005 05:31)

A geneic fileupload class is included here....
// author: Suri Bala
// freely distributable
class fileupload{
 private $upload_tmp_dir = "/tmp/";  // leading and trailing slash required
 private $file_upload_flag = "off";
 private $upload_max_filesize = "100";
 private $allowable_upload_base_dirs = array("/tmp/", "/web/dynawolf/uploads/");
 private $allowable_upload_tmp_dirs = array( "/tmp/");
 private $upload_dir= "/tmp/";  // leading and trailing slash required
 private $upload_file_name;
 function __construct($name) {
     if( is_null($_FILES[$name]) )  {
        echo "Specified file <strong> ".$name." </strong> does not exist in the FILES array. Please check if it exists";
        echo "Exiting...";
     if( $this->file_upload_flag == "off" ) {
       echo "File upload capability in the configuration file is turned <strong> off </strong> . Please update the php.ini file.";
     $this->upload_file_name = $name;
 private function getConfigurationSettings() {
     $this->file_upload_flag = ini_get('file_uploads');
     $this->upload_tmp_dir = ini_get('upload_tmp_dir');
     $this->upload_max_filesize = ini_get('upload_max_filesize');
     $this->upload_max_filesize = preg_replace('/M/', '000000', $this->upload_max_filesize);
 public function getErrors() {
     return $_FILES[$this->upload_file_name]['error'];
 public function getFileSize() {
     return $_FILES[$this->upload_file_name]['size'];
 public function getFileName() {
     return $_FILES[$this->upload_file_name]['name'];
 public function getTmpName() {
     return $_FILES[$this->upload_file_name]['tmp_name'];
 public function setUploadDir($upload_dir) {
   if( $upload_dir[strlen($upload_dir)-1] != "/" ) $upload_dir .= "/"; // add trailing slash
   $can_upload = false;
   foreach( $this->allowable_upload_base_dirs as $dir ) {
      if( $dir == $upload_dir ) {
$can_upload = true;
   if( !$can_upload ) {
      echo "Cannot upload to the dir ->".$upload_dir;
      $this->upload_dir = $upload_dir;
      echo $this->upload_dir;
 public function setTmpUploadDir($upload_tmp_dir) {
   if( $upload_tmp_dir[strlen($upload_tmp_dir)-1] != "/" ) $upload_tmp_dir .= "/"; // add trailing slash
   $can_upload = false;
   foreach( $this->allowable_upload_base_dirs as $dir ) {
      if( $dir == $upload_tmp_dir ) {
$can_upload = true;
   if( !$can_upload ) {
      echo "Cannot upload to the dir ->".$uplaod_tmp_dir;
   $this->upload_tmp_dir = $upload_dir;
 public function uploadFile() {
   if( $this->checkMaxMemorySizeLimit() ) {
      echo "File size of ".$this->getFileSize()." greater than allowable limit of ".$this->upload_max_filesize."Please change the configuration setting.";
     if( !move_uploaded_file($this->getTmpName(), $this->upload_dir.$this->getFileName()) ) {
        echo "Failed to upload file ".$this->getTmpName();
 public function checkMaxMemorySizeLimit() {
   if( $this->getFileSize() >  $this->upload_max_filesize ) {
     return true;
     return false;

sgarner(a)expio.co.nz (21-Jun-2005 05:52)

Internet Explorer has problems with submitting forms with enctype="multipart/form-data" (e.g. uploading files) when combined with text fields containing non-standard ASCII characters (e.g. smart quotes or em-dashes) and a non-Windows-1255 character encoding.
Many Apache 2.0 default configs (e.g. Fedora 3) ship with "AddDefaultCharset UTF-8" in the httpd.conf. Commenting out this line will resolve the problem (assuming no charset is defined using <meta> tags in the page as well).
The problem manifests when submitting the form; the input field containing characters like ©, —, “, ” (common in text copied from MS Word) will appear blank to the receiving page.

keith at phpdiary dot org (24-May-2005 12:14)

Caution: *DO NOT* trust $_FILES['userfile']['type'] to verify the uploaded filetype; if you do so your server could be compromised.  I'll show you why below:
The manual (if you scroll above) states: $_FILES['userfile']['type'] -  The mime type of the file, if the browser provided this information. An example would be "image/gif".
Be reminded that this mime type can easily be faked as PHP doesn't go very far in verifying whether it really is what the end user reported!
So, someone could upload a nasty .php script as an "image/gif" and execute the url to the "image".
My best bet would be for you to check the extension of the file and using exif_imagetype() to check for valid images.  Many people have suggested the use of getimagesize() which returns an array if the file is indeed an image and false otherwise, but exif_imagetype() is much faster. (the manual says it so)

(20-May-2005 03:47)

In case you want to show live upload progress bar or detect file size before upload completes this might help:

ceo at l-i-e dot com (20-May-2005 04:25)

Using /var/www/uploads in the example code is just criminal, imnsho.
One should *NOT* upload untrusted files into your web tree, on any server.
Nor should any directory within your web tree have permissions sufficient for an upload to succeed, on a shared server. Any other user on that shared server could write a PHP script to dump anything they want in there!
The $_FILES['userfile']['type'] is essentially USELESS.
A. Browsers aren't consistent in their mime-types, so you'll never catch all the possible combinations of types for any given file format.
B. It can be forged, so it's crappy security anyway.
One's code should INSPECT the actual file to see if it looks kosher.
For example, images can quickly and easily be run through imagegetsize and you at least know the first N bytes LOOK like an image.  That doesn't guarantee it's a valid image, but it makes it much less likely to be a workable security breaching file.
For Un*x based servers, one could use exec and 'file' command to see if the Operating System thinks the internal contents seem consistent with the data type you expect.
I've had trouble in the past with reading the '/tmp' file in a file upload.  It would be nice if PHP let me read that file BEFORE I tried to move_uploaded_file on it, but PHP won't, presumably under the assumption that I'd be doing something dangerous to read an untrusted file.  Fine.   One should move the uploaded file to some staging directory.  Then you check out its contents as thoroughly as you can.  THEN, if it seems kosher, move it into a directory outside your web tree.  Any access to that file should be through a PHP script which reads the file.  Putting it into your web tree, even with all the checks you can think of, is just too dangerous, imnsho.
There are more than a few User Contributed notes here with naive (bad) advice.  Be wary.

Andrea_1 (30-Apr-2005 05:47)

I want to share a really easy way of uploading files to your web host from a form!
Someone suggested it way down in these notes. I tried it and it's working!!
Go to http://pear.php.net/index.php
Then go to:
You download the main pear.php files and then the HTTP_Upload file. Upload it to your web host and within minutes, the example will be working!
I'm going to look further on that pear.php.net site too - it looks like they have a lot of good addition for complex PHP functions!

Steven (29-Apr-2005 12:30)

Need to get around your PHP.ini file upload limit?
Use a bit of clever JavaScript to get the value of your <input type="file"> (the location of the file on the client's machine), copy it to a hidden text box then try and upload traditionally, if you get a PHP error UPLOAD_ERR_INI_SIZE, then use the value of your hidden text box to initiate a PHP-FTP connection and upload to your heart's content.  
No more limits :)

Sa_Estahbanati at yahoo dot com (27-Apr-2005 01:47)

In the above notes there was solution to the server-side code that would use move_uploaded_file() to save the temporary file into a permanent path.
A pal maitaned that relative path would have problem in windows servers and you should indicate the complete path instead. While it is almost impossible to ge to know the exact path when you are not the host, I tried to test other ways and finally found out that a simple "." (dot) before tha path would solve the relative pathing problem.
instead of '/var/www/uploads/' or 'E:/sitebase/var/www/uploads/' you should type './var/www/uploads/'
Here is the complete source:
// In PHP versions earlier than 4.1.0, $HTTP_POST_FILES should be used instead
// of $_FILES.
//$uploaddir = 'E:/sitebase/var/www/uploads/';
//$uploaddir = '/var/www/uploads/';
$uploaddir = './var/www/uploads/';
$uploadfile = $uploaddir . basename($_FILES['userfile']['name']);
echo '<pre>';
if (move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile)) {
  echo "File is valid, and was successfully uploaded.\n";
} else {
  echo "Possible file upload attack!\n";
echo 'Here is some more debugging info:';
print "</pre>";

dmsuperman at comcast dot net (26-Apr-2005 07:00)

I needed a file uploader for a client a little while ago, then the client didn't want it, so I'll share with all of you. I know I hated coding it, it was confusing (for me anyway), but I made it fairly simple to use:
function uploader($num_of_uploads=1, $file_types_array=array("txt"), $max_file_size=1048576, $upload_dir=""){
   $max_file_size = 1048576;
   $form = "<form action='".$PHP_SELF."' method='post' enctype='multipart/form-data'>Upload files:<br /><input type='hidden' name='submitted' value='TRUE' id='".time()."'><input type='hidden' name='MAX_FILE_SIZE' value='".$max_file_size."'>";
     $form .= "<input type='file' name='file[]'><font color='red'>*</font><br />";
   $form .= "<input type='submit' value='Upload'><br /><font color='red'>*</font>Maximum file length (minus extension) is 15 characters. Anything over that will be cut to only 15 characters. Valid file type(s): ";
       $form .= $file_types_array[$x].", ";
       $form .= $file_types_array[$x].".";
   $form .= "</form>";
   foreach($_FILES["file"]["error"] as $key => $value){
         $origfilename = $_FILES["file"]["name"][$key];
         $filename = explode(".", $_FILES["file"]["name"][$key]);
         $filenameext = $filename[count($filename)-1];
         $filename = implode(".", $filename);
         $filename = substr($filename, 0, 15).".".$filenameext;
         $file_ext_allow = FALSE;
             $file_ext_allow = TRUE;
             if(move_uploaded_file($_FILES["file"]["tmp_name"][$key], $upload_dir.$filename)){
               echo("File uploaded successfully. - <a href='".$upload_dir.$filename."' target='_blank'>".$filename."</a><br />");
               echo($origfilename." was not successfully uploaded<br />");
             echo($origfilename." was too big, not uploaded<br />");
           echo($origfilename." had an invalid file extension, not uploaded<br />");
         echo($origfilename." was not successfully uploaded<br />");
uploader([int num_uploads [, arr file_types [, int file_size [, str upload_dir ]]]]);
num_uploads = Number of uploads to handle at once.
file_types = An array of all the file types you wish to use. The default is txt only.
file_size = The maximum file size of EACH file. A non-number will results in using the default 1mb filesize.
upload_dir = The directory to upload to, make sure this ends with a /
This functions echo()'s the whole uploader, and submits to itself, you need not do a thing but put uploader(); to have a simple 1 file upload with all defaults.

oportocala at DON'T GET SPAM dot yahoo dot comerce (22-Apr-2005 02:59)

I had some problems with uploading files because of the path .So to save you some problems. if you get an error like "failed to open stream: No such file or directory in ..." it's likely because your not specifing the full path of the directory you want to upload.In other words you need to specify the full path and not the relative path in the second parameter.
Here is a small function to upload stuff. The files get their new name via last index from a database.

 $name_tmp = $HTTP_POST_FILES['file']['tmp_name'];
//read temporay filename
 $name = $HTTP_POST_FILES['file']['name'];
//read initial filename
$ext =explode('.', $name);
$ext = $ext[count($ext)-1];
//get extension of uploaded file
       $index=getLastIndex();//costum function
$path_parts = pathinfo(__file__);//get path info of curent php script
   $dir = $path_parts['dirname']."\\uploads"; //full path of upload directory
$new = $dir."\\".$index.".".$ext;
echo "File transfer succesfull.";

Jared (20-Apr-2005 03:07)

If you want a unique filenames to prevent overwritting is to use sha1_file().
if (isset($_FILES['pic']))
$file = $_FILES['pic'];
if ($file['error'] == UPLOAD_ERR_OK)
$name = sha1_file($file['tmp_name']);
$pathInfo = pathinfo($file['name']);
if (isset($pathInfo['extension']))
$name .= '.'.$pathInfo['extension'];
if (move_uploaded_file($file['tmp_name'], $uploaddir.$name))
// ..ok..
// ..failed..
Its unlikely 2 files will ever get the same filename, unless they are the same.

trog at swmud dot pl (12-Apr-2005 12:07)

The best way of getting unique filenames, in order to
prevent accidental file overwriting during e.g. upload is
to use functions:
- uniqid
- time
- md5
It is not recommended to use just time() function.
The example code will explain.
The code:
   for( $i = 0; $i < 10; $i++ )
       echo 'Time: '.time().' ID: '.md5(uniqid(time())).".\n";
Example output:
Time: 1113310579 ID: 79955ae9bc455a33aed92de6b83e1a4a.
Time: 1113310579 ID: 45de8a2173b53c33659cafa1d564f49a.
Time: 1113310579 ID: 9377a0e655efd206ca5583b6530706cd.
Time: 1113310579 ID: 06a86b2c9678adb7f222984019a14c10.
Time: 1113310579 ID: 25fe1664af35ebb3347f04cf703be968.
Time: 1113310579 ID: dca7397eb4d7d5c44e34b0a16a6fc89e.
Time: 1113310579 ID: fa01b6a2a83fbaefd89306d27835101f.
Time: 1113310579 ID: cf20ada42f2248c3c8b67f46b1d97401.
Time: 1113310579 ID: 9ab1a24c7f576fe0e6add43b848660ac.
Time: 1113310579 ID: c6aa6e9e314b4392c94432ece411824e.
The ids are unique and this is what we want.
Now just append or prepend this id to the original filename and we
have unique filename every time.
   $unique_id = md5(uniqid(time()));
   $filename = $unique_id.'_'.$filename;

bryan dot fillmer at beasleyallen dot com (04-Apr-2005 04:08)

I looked high and low for a simple way to rename files as they are uploaded to prevent users from overwriting each others files. Below is the script I came up with.
foreach( $_FILES["screenshots"]["error"] as $key => $error ) {

if( $error == UPLOAD_ERR_OK ) {
$tmp_name = $_FILES["screenshots"]["tmp_name"][$key];
$original_name = $_FILES["screenshots"]["name"][$key];
$tmp_array = preg_split( "/\\\/",$tmp_name );
$file_name = $tmp_array[count($array)-1];
$extension = preg_replace( "/(.*)\.([a-z]+)$/","$2",$original_name );
$new_name = preg_replace( "/(.*)\.([a-z]+)$/","$1.$extension",$file_name );
move_uploaded_file( $tmp_name,"./screenshots/$new_name" );

I started with the generic multiple file upload script in the documentation above and worked from there.

robpet at tds dot net (03-Apr-2005 07:35)

People have remarked that incorrect permissions on the upload directory may prevent photos or other files from uploading.  Setting the Apache owner of the directory incorrectly will also prevent files from uploading -- I use a PHP script that creates a directory (if it doesn't exist already) before placing an uploaded file into it.  When the script creates the directory and then copies the uploaded file into the directory there is no problem because the owner of the file is whatever Apache is running as, typically "nobody". However, lets say that I've moved the site to a new server and have copied over existing file directories using FTP.  In this case the owner will have a different name from the Apache owner and files will not upload. The solution is to TelNet into the site and reset the owner to "nobody" or whatever Apache is running as using the CHOWN command.

javasri at yahoo dot com (30-Mar-2005 11:34)

On windows XP, SP2, Explorer at times fails to upload files without extensions.
$_FILES array is null in that case. Microsoft says its a security feature(!)
The only solution we could comeup is to enforce uploaded file  to have an extention.

james [at] adultphpsolutions [dot] com (24-Mar-2005 08:21)

Well let me ask you this?  Why would you compromise security doing this?  Might as well just turn off IP tables, you're basically allowing any connections to any port on your server, bad move.  I don't have those and have no problem uploading files.  
"The iptables rules for this are as follows:
# allow all fragments
# allow icmp traffic
-A INPUT -p icmp -j ACCEPT" <-- From guy below me...
On the bright side, this will also fix some issues with ssh and NFS =)
On another note, a smart programmer would also do checking on the files that are uploaded, making sure that they are the correct file, it is another breach in security not by checking the files you are uploading are in a web viewable area.  Just my two cents...

thisisroot at gmail dot com (14-Mar-2005 03:33)

If you're having problems uploading large files but small files go through fine, here are some things to try:
- In the HTML form, make sure you've set MAX_FILE_SIZE to an acceptable value.
- In php.ini, be sure you've set the the upload_max_filesize and post_max_size to be large enough to handle your upload.
- In your httpd.conf (if you're using apache), check that the LimitRequestBody directive isn't set too low (it's optional, so it may not be there at all).
If those settings don't work, you can check your firewall configuration. When uploading large files, packets have to be split into fragments of varying size depending on your systems MTU (maximum transmission unit), which is typically 1500 bytes.
Because some systems send the packets with the headers last (or the header packet may be received after some of the data packets), firewalls can't filter this traffic based on destination port and address. Many firewalls (including iptables) have to be configured to allow fragments separately from standard traffic. Unfortunately, it's an all-or-nothing thing in these cases, and exploits based on packet fragmentation have been a problem in the past (teardrop, boink, etc.). Note that ICMP may be used to notify the host (your server) of oncoming fragmentation, so you may need to allow ICMP traffic as well.
The iptables rules for this are as follows:
# allow all fragments
# allow icmp traffic
-A INPUT -p icmp -j ACCEPT
On the bright side, this will also fix some issues with ssh and NFS =)

(27-Feb-2005 06:06)

Just to remind everyone, if you are wanting to upload larger files, you will need to change the value of both upload_max_filesize and post_max_size to the largest filesize you would like to allow.  Then restart apache and everything should work.

infoworks-tn dot com at david dot hamilton dot nospam (27-Feb-2005 04:52)

Regarding the post by therebechips below about saving attachments to a MySQL database.  Here are some items that he forgot to mention:
Make sure your datafield is type text for storing the chunks in.  base64_encode translates binary into text (in a nutshell).  
Also, the max size for a text field is 65535.  In his example he used 50,000 for the MAX_SQL chunks to put into the database.  If you do this, the encoded data is too large to fit in the field and is truncated.  Use 40,000 instead to be safe.  It took me a few hours to realize why my images were coming back out of the database corrupted.
Other than that, his example worked very well.  
If you want to email me, flip the two parts of my email address around and remove .nospam
David Hamilton

Leevi at izilla dot com dot au (09-Feb-2005 06:52)

This may help a newbie to file uploads.. it took advice from a friend to fix it..
If you are using
-windows xp
-iis 5
-php 5
If you keep getting permission errors on file uploads... and you have sworn you set the permissions to write to the directory in iis...
double check that
a) in windows explorer under tools > folder options
click the view tab
scroll down all the way to "use simple file sharing (recommended)"
uncheck this box
b) find the folder you wish to upload to on your server
c) click properties and then the security tab
d) make sure the appropriate write settings are checked.
you may want to test by setting "everyone" to have full permission....
BEWARE doing this will open up big security holes on your server....
hope this helps
Leevi Graham

phpnoob at adam dot net dot nz (09-Feb-2005 01:57)

Just thought I'd add this since I had to search forever to find an answer.  
When I used the enctype attribute on a form to process a file upload I had a problem redirecting back to an anchor point on the original page my code looked like this on the upload page:
header("Location: original_page.php#image_gal");
and the resulting url looked like this:
note the missing anchor reference.  So my work around was to pass the anchor point as a variable and then redirect again when I got to the original page.  A little bit chunky but it worked.  Hope this helps someone.

Tyfud (07-Jan-2005 04:44)

It's important to note that when using the move_uploaded_file() command, that some configurations (Especially IIS) will fail if you prefix the destination path with a leading "/". Try the following:
Setting up permissions is also a must. Make sure all accounts have write access to your upload directory, and read access if you wish to view these files later. You might have to chmod() the directory or file afterwards as well if you're still getting access errors.

lobo235 at gmail dot com (04-Jan-2005 10:48)

Be sure to be careful with the $_FILES['userfile']['name'] array element. If the client uploads a file that has an apostrophe in the filename it WILL NOT get set to the full name of the file from the client's machine.
For example, if the client uploads a file named george's car.jpg the $_FILES['userfile']['name'] element will be set to s car.jpg because PHP appears to cut off everything before the apostrophe as well as the apostrophe itself.
This did not happen in some of the previous versions of PHP but I know that it happens in version 4.3.10 so watch out for this.
I thought this was a bug so I submitted it but it turns out that it is a "security measure"

ryan dot baclit at gmail dot com (15-Dec-2004 07:15)

Hello everyone. I want to share to you that uploading will never work out of the box if you didn't set the upload_tmp_dir directive in your php.ini file in the first place. If you just compiled the source files as is and tried to upload, you're in for a big mess. I don't know the flags to pass to the configure script to tell php about the default temporary directory to place the uploaded files.
In case your php upload code won't do as expected, open up the php.ini file and set the upload_tmp_dir. Then restart the Apache server and you're set.
By the way, I'm using Linux Mandrake 10.1 Official and PHP 4.3.9 on Apache 2.0.49.

captlid (08-Nov-2004 06:37)

mime_content_type() is better to use if you want to find if a file sent is really a jpeg or a plain text file. :)

therhinoman at hotmail dot com (27-Aug-2004 09:20)

If your upload script is meant only for uploading images, you can use the image function getimagesize() (does not require the GD image library) to make sure you're really getting an image and also filter image types.
<?php getimagesize($file); ?>
...will return false if the file is not an image or is not accessable, otherwise it will return an array...
$file = 'somefile.jpg';
# assuming you've already taken some other
# preventive measures such as checking file
# extensions...
$result_array = getimagesize($file);
if ($result_array !== false) {
   $mime_type = $result_array['mime'];
   switch($mime_type) {
       case "image/jpeg":
           echo "file is jpeg type";
       case "image/gif":
           echo "file is gif type";
           echo "file is an image, but not of gif or jpeg type";
} else {
   echo "file is not a valid image file";
using this function along with others mentioned on this page, image ploading can be made pretty much fool-proof.
See http://php.net/manual/en/function.getimagesize.php for supported image types and more info.

olijon, iceland (19-Jun-2004 04:24)

When uploading large images, I got a "Document contains no data" error when using Netscape and an error page when using Explorer. My server setup is RH Linux 9, Apache 2 and PHP 4.3.
I found out that the following entry in the httpd.conf file was missing:
<Files *.php>
 SetOutputFilter PHP
 SetInputFilter PHP
 LimitRequestBody 524288 (max size in bytes)
When this had been added, everything worked smoothly.
- Oli Jon, Iceland

brion at pobox dot com (11-May-2004 02:08)

Note that with magic_quotes_gpc on, the uploaded filename has backslashes added *but the tmp_name does not*. On Windows where the tmp_name path includes backslashes, you *must not* run stripslashes() on the tmp_name, so keep that in mind when de-magic_quotes-izing your input.

steve dot criddle at crd-sector dot com (16-Apr-2004 07:43)

IE on the Mac is a bit troublesome.  If you are uploading a file with an unknown file suffix, IE uploads the file with a mime type of "application/x-macbinary".  The resulting file includes the resource fork wrapped around the file.  Not terribly useful.
The following code assumes that the mime type is in $type, and that you have loaded the file's contents into $content.  If the file is in MacBinary format, it delves into the resource fork header, gets the length of the data fork (bytes 83-86) and uses that to get rid of the resource fork.
(There is probably a better way to do it, but this solved my problem):
if ($type == 'application/x-macbinary') {
   if (strlen($content) < 128) die('File too small');
   $length = 0;
   for ($i=83; $i<=86; $i++) {
       $length = ($length * 256) + ord(substr($content,$i,1));
   $content = substr($content,128,$length);

hisham (02-Mar-2004 06:54)

On a similar note to jim dot dam at sympatico dot ca 27-Feb-2002 09:13
Browsers intepret png upload type differently too eg.
print_r() output from Mozilla 1.6
Array ( [name] => eg1.png [type] => image/png [tmp_name] => /var/tmp/phpIJd4FL [error] => 0 [size] => 66614 )
print_r() output from IE 6
Array ( [name] => eg1.png [type] => image/x-png [tmp_name] => /var/tmp/phpHJ04Dh [error] => 0 [size] => 66614 )
Note the difference of image/png and image/x-png type intepretation of the same image file.
Further note:

~caetin~ ( at ) ~hotpop~ ( dot ) ~com~ (11-Feb-2004 04:37)

From the manual:
    If no file is selected for upload in your form, PHP will return $_FILES['userfile']['size'] as 0, and $_FILES['userfile']['tmp_name'] as none.
As of PHP 4.2.0, the "none" is no longer a reliable determinant of no file uploaded. It's documented if you click on the "error codes" link, but you need to look at the $_FILES['your_file']['error']. If it's 4, then no file was selected.

maya_gomez ~ at ~ mail ~ dot ~ ru (06-Feb-2004 01:20)

when you upload the file, $_FILES['file']['name'] contains its original name converted into server's default charset.
if a name contain characters that aren't present in default charset, the conversion fails and the $_FILES['file']['name'] remains in original charset.
i've got this behavior when uploading from a windows-1251 environment into koi8-r. if a filename has the number sign "¹" (0xb9), it DOES NOT GET CONVERTED as soon as there is no such character in koi8-r.
Workaround i use:
if (strstr ($_FILES['file']['name'], chr(0xb9)) != "")
   $_FILES['file']['name'] = iconv (
       str_replace (chr(0xb9), "N.", $_FILES['file']['name']));

srikanth at ideaworks3d dot com (19-Jan-2004 06:18)

If the file is empty (0 bytes) it is treated as if no file
is uploaded. $_FILES['userfile']['tmp_name'] returns "none".

therebechips (06-Sep-2003 10:02)

Re: Handling uploads and downloads of large files and storing in MySQL.
Use two tables to store data about the file and the file data itself. ***Important: to preserve the integrity of the data use base64_encode() NOT addslashes().
// Max packet size
$filehandle = fopen($tmp, "rb") or die( "Can't open file!" );
$query= "INSERT INTO files (name, type, size) VALUES(".
$DB->quote($name).", ".
$DB->quote($type).", ".
// Execute Query
$result = $DB->query($query);
$file_id = mysql_insert_id();
// Copy the binary file data to the filedata table in sequential rows each containing MAX_SQL bytes
// Your table should have an index set to auto_increment
// Store the file_id to identify the data fragments
while (!feof ($filehandle)) {
$data = base64_encode(fread($filehandle,MAX_SQL));
$query = "INSERT INTO filedata (file_id, data) VALUES($file_id,\"".$data."\")";
$result = $DB->query($query);
fclose ($filehandle);
Decode the data fragments and recombine them:
$file_id =$_GET ['file_id'];
$query ="select file_id, name, type, size from files where file_id='$file_id'";
$result = $DB->query($query);
$row= mysql_fetch_array ($result);
$type = $row ["type"];
$name = $row ["name"];
$size = $row ["size"];
$file_id = $row ["file_id"];
// get the file data
$query = "select id, data from filedata where file_id='$file_id' ORDER by id";
$result = $DB->query($query);
// decode the fragments and recombine the file
$data = "";
while ($row = mysql_fetch_array($result)) {
$data .= base64_decode($row ["data"]);  

// output the file
header ("Content-type: $type");
header ("Content-length: $size");
header ("Content-Disposition: attachment; filename=$name");
header ("Content-Description: PHP Generated Data");
echo $data;

e4c5 at raditha dot com (12-Aug-2003 10:22)

Progress bar support has been a recurring theme in many a PHP mailing list over the years. You can find a free progress monitor component for PHP file uploads at http://sourceforge.net/projects/megaupload/
The advantage of this system is that you do not have to apply any patches to PHP to make use of it.

diegoful at yahoo dot com (25-Mar-2003 08:22)

SECURITY CONSIDERATION: If you are saving all uploaded files to a directory accesible with an URL, remember to filter files not only by mime-type (e.g. image/gif), but also by extension. The mime-type is reported by the client, if you trust him, he can upload a php file as an image and then request it, executing malicious code.
I hope I am not giving hackers a good idea anymore than I am giving it to good-intended developers. Cheers.

garyds at miraclemedia dot ca (16-Mar-2003 02:12)

As it has been mentioned above, Windows-based servers have trouble with the path to move the uploaded file to when using move_uploaded_file()... this may also be the reason copy() works and not move_uploaded_file(), but of course move_uploaded_file() is a much better method to use. The solution in the aforementioned note said you must use "\\" in the path, but I found "/" works as well. So to get a working path, I used something to the effect of:
...which worked like a charm.
I am using PHP 4.3.0 on a win2k server.
Hope this helps!

ov at xs4all dot nl (09-Mar-2003 03:08)

This took me a few days to find out: when uploading large files with a slow connection to my WIN2K/IIS5/PHP4 server the POST form kept timing out at exactly 5 minutes. All PHP.INI settings were large enough to accomodate huge file uploads. Searched like hell with keywords like "file upload php timeout script" until I realised that I installed PHP as CGI and added that as a keyword. This was the solution:
To set the timeout value:
1. In the Internet Information Services snap-in, select the computer icon and open its property sheets.
2. Under Master Properties, select WWW Service, and then click the Edit button
3. Click the Home Directory tab.
4. Click the Configuration button.
5. Click the Process Options tab, and then type the timeout period in the CGI Script Timeout box.

mccorkle+php at devteam dot org (08-Jan-2003 07:59)

To anyone that is trying to use values="foo" to set a default value in a input type of ``file'', I found this out from http://www.blooberry.com/indexdot/html/tagpages/i/inputfile.htm:
*  Internet Explorer, Netscape and Opera do not use the VALUE attribute as the default contents of the input area. Any default value set via HTML is not usable via scripting and the DOM as well (hence it is not listed as 'supported' in any of the browsers.) If a user enters text in the field however, that value is then reachable via the DOM as it normally would be for a normal INPUT field (via the .value property.) The reason for this behavior would presumably be to ensure the security/safety of users against malicious authors.
Tooke me a bit to find this, so I figured I'd share.

travis dot lewis at amd dot com (04-Dec-2002 08:58)

If you we dumb like me you installed Redhat 8.0 and kept the default install of packages for Apache 2.0 and PHP4.2.2.  I could not upload any files larger than 512kB and all the php directorives were set to 32MB or higher.
memory_limit = 128M
post_max_size = 64M
upload_max_filesize = 32M
And my upload web page was set to 32MB as well:
<Form ID="frmAttach" Name="frmAttach" enctype="multipart/form-data" action="attachments.php" method="POST">
<input type="hidden" name="MAX_FILE_SIZE" value="33554432" />
However, the insiduous php.conf (/etc/httpd/conf.d/php.conf) file used by default RPM install of Redhat httpd has a LimitRequestBody set to 512kB ("524288" ).  Adjusting this to 32MB ("33554432") got things going for the larger files.  Here is my php.conf file in its entirety.  Hope this helps someone.  L8er.
# PHP is an HTML-embedded scripting language which attempts to make it
# easy for developers to write dynamically generated webpages.
LoadModule php4_module modules/libphp4.so
# Cause the PHP interpreter handle files with a .php extension.
<Files *.php>
   SetOutputFilter PHP
   SetInputFilter PHP
   LimitRequestBody 33554432
# Add index.php to the list of files that will be served as directory
# indexes.

solja at gci dot net (04-May-2002 02:11)

Just another way I found to keep an uploaded file from overwriting an already exisiting one - I prefix each uploaded file with time() timestamp. Something like:
$unique_id = time();
Then when I give the new name to move the file to, I use something like:
So I get a fairly unique filename each time a file is uploaded. Obviously, if two files are uploaded at once, both will have the same timestamp, but I don't worry too much about that. Hope this might help someone.

am at netactor dot NO_SPAN dot com (15-Mar-2002 06:20)

Your binary files may be uploaded incorrectly if you use modules what recode characters. For example, for Russian Apache, you should use
<Files ScriptThatReceivesUploads.php>
CharsetDisable On

 prev: Dealing with XForms
Lee W, MVPTechnology and Business Process AdvisorCommented:
In most cases, storing music or other large binary data into a database is not considered a good idea.  A better method would be to store the music on the hard drive and store the path to it in the database.
Ameerh24Author Commented:
then how could I save the track from user pc to my server hard drive?
Ameerh24Author Commented:
Thanks alot.. That was Just a great and giant explanation ..

agian .. thanks alot
Richard QuadlingSenior Software DeveloperCommented:
Oh.Sorry for the HUGE post. I don't think I meant to include all the user notes as well, but hey! They are useful!
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.