PHP图像验证脚本

Question

I would like to make an image validation script for making news items. As I already searched for other examples my PHP knowlegde isn't that great to implement it.

HTML:

<input class="form-control contact-control" type="hidden" name="MAX_FILE_SIZE" value="1000000">
<input class="form-control contact-control" type="file" name="image" id="image">

PHP:

$news_item = $_POST['item'];
$news_date = $_POST['date'];
$news_text = $_POST['text'];
$max_file_size = 1000000;
$path = ("../../../database/img/");
$news_image = $_FILES['image']['name']; 
$image_size = $_FILES['image']['size'];
$image_type = $_FILES['image']['type'];

    if(!empty($news_item) && !empty($news_date) && !empty($news_text) && !empty($news_image)) {
        if(($image_type == 'image/jpeg') || ($image_type == 'image/png') || ($image_type == 'image/gif') && ($image_size > 0) && ($image_size <= $max_file_size)) {
            if($_FILES['file']['error'] == 0) {
                $target = $path . $news_image;
                if(move_uploaded_file($_FILES['image']['tpm_name'], $target)) {
                    $query_news = "INSERT INTO news(Item, Date_item, News_text, Photo) VALUES('".$news_item."', '".$news_date."', '".$news_text."', '".$uploaded_dir.$news_image."')";
                    mysql_query($query_news);
                } else {
                    $update_news = "UPDATE news SET Item = '".$news_item."', Date_item = '".$news_date."', News_text = '".$news_text."', Photo = '".$uploaded_dir.$news_image."'";
                    mysql_query($update_news);
                }
            }
        } else {
            echo 'The screenshot must be a GIF, JPEG or PNG image no ' . 'less than ' . ($max_file_size / 1000000) . 'mb in size.';
        }

        @unlink($_FILES['image']['tmp_name']);

    } else {
        echo 'Please enter alll of the information.';
    }

There isn't added a new row of information into the database and also no image stored. As I suspect one of the if statement goes false.

Answer 1

First, you don't need to remove a temp file @unlink($_FILES['image']['tmp_name']); . Just delete this line.

Second, your script is exposed to SQL Injection because you use POST values directly without filtration.

Third, you have a type here: if(move_uploaded_file($_FILES['image']['tpm_name'], $target)) { . Array key right name is tmp_name .

Answer 2

You have a typo.

($_FILES['image']['tpm_name'], $target)
                   ^^^^^^^^

Change it to ($_FILES['image']['tmp_name'], $target)

BUT, this $uploaded_dir is still unassigned which most likely seems it should be $target