Link to home
Start Free TrialLog in
Avatar of christamcc
christamccFlag for United States of America

asked on

PHP Form validation and Upload

I asked this question here on E-E.

While understand what they are saying, I don't know how to implement it.

Can someone give an example with a form with say one required input text field and the input file field?  (So the input text field failed validation and the page postsback, they don't have to re-choose the file.)

Thanks!
Avatar of Loganathan Natarajan
Loganathan Natarajan
Flag of India image

In that case,  you can validate the input text field using AJAX way.

http://bassistance.de/jquery-plugins/jquery-plugin-validation/

Demo,
http://jquery.bassistance.de/validate/demo/

but still, you can't reload the file choosen in file input field. it is against security issue.
... they don't have to re-choose the file
This is highly problematic in your design.  Think about the security implications.  If you could prepopulate the values in $_FILES (<input type="file"...>) the server would be able to access any file on the client machine without permission.  Should you ever find a way to do that, the security experts will shut it down immediately.

As I wrote here, you should not design an application this way.
https://www.experts-exchange.com/questions/27837349/PHP-Populate-input-type-file-field-from-stored-value.html

Instead, you might try things more like this.  A first form captures the text and the file, and the action script uploads the file and stores it in a predictable location, saving the URL of the stored file in the PHP session.  Then the action script validates the text.  If the text does not pass validation, the action script presents a form to the client asking her to replace the text with something that passes validation.

I'll try to write a demonstration script for you if I get time later today.

Best regards, ~Ray
Avatar of christamcc

ASKER

I have Jquery validation implemented on the form so it is unlikely that I will be in this predicament, but using client side as a backup.

When I said "they don't have to re-choose the file" what I was thinking that IF there is a blank secondary field then the file gets saved and when the form posts back the step "Choose" would instead say File Chosen and show the name of the file (thereby not having to rechoose it).  And then on that form's postback I would move_uploaded_file.  That was my understanding of what the solution was on my original E-E question.

What do people usually do in this situation, it seems like most people wouldn't want their users to have to rechoose the file upon form validation error? Do they just rely on client side form validation?
Otherwise, once the file is chosen you can upload it then do the validation
ASKER CERTIFIED SOLUTION
Avatar of Ray Paseur
Ray Paseur
Flag of United States of America image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Does move_uploaded_file() take time to upload?  For example some files may be over 100megs.. which could take a while...  would this be happening while they attempted to correct the errors on the form... and if they wanted to select a different file instead would the first file just continue to "move" while the new correct form was being submitted?

Separately: While I do appreciated the info I received, this post immediately got offtrack from my initial request of "Can someone give an example with a form with say one required input text field and the input file field?"

Because of where this post has gone,  I'll close the question out when the new question in this comment is answered (about the move) and will create a new question asking for the sample.
The info was really good, but was sort of an expanded repeat of the answer that I referenced in this question.  My actual question was never answered...
Well, this one has been hanging out there for a long time, hasn't it!  The question assumes the existence of a mechanism that does not exist and cannot exist in the context of HTTP security rules.  To anyone in the future who may be viewing this question, please understand that you cannot prepopulate the contents of the input type="file" under any circumstances.