无法使用PHP上传文件？

Question

Can you anyone look at my code? 有人可以看一下我的代码吗？ People can click the upload button to upload some file and the code should move it to a new location and save it. 人们可以单击“上传”按钮上传一些文件，并且代码应将其移动到新位置并保存。 I tested it by uploading a image file and I cant find that file in the folder I specified. 我通过上传图像文件进行了测试，但在指定的文件夹中找不到该文件。 I am certain the directory is correct because I used directory is folder and it can lead to the folder I want it to be in. Because the dir below has my name, I used "1" instead. 我确定目录是正确的，因为我使用的目录是folder，它可以导致我要放入的文件夹。因为下面的目录具有我的名字，所以我改用“ 1”。 Thank you in advance! 先感谢您！

I changed the code according to answer but it is still giving me back error: Warning: move_uploaded_file(/Users/angeloliao/Documents/Screen.tiff): failed to open stream: Permission denied in /usr/local/zend/apache2/htdocs/JuvoliciousProductViewer/5.php on line 16 我根据答案更改了代码，但仍给我返回错误：警告：move_uploaded_file（/Users/angeloliao/Documents/Screen.tiff）：无法打开流：/ usr / local / zend / apache2 / htdocs中的权限被拒绝/JuvoliciousProductViewer/5.php在第16行

Warning: move_uploaded_file(): Unable to move '/usr/local/zend/tmp/phpdfCRD3' to '/Users/angeloliao/Documents/Screen.tiff' in /usr/local/zend/apache2/htdocs/JuvoliciousProductViewer/5.php on line 16 警告：move_uploaded_file（）：无法将/ usr / local / zend / apache2 / htdocs / JuvoliciousProductViewer / 5中的'/ usr / local / zend / tmp / phpdfCRD3'移动到'/Users/angeloliao/Documents/Screen.tiff'。第16行的php

I tried to change the folder's permission using the following command on terminal: sudo chown -R 0755 /Users/angeloliao/Documents. 我试图在终端上使用以下命令更改文件夹的权限：sudo chown -R 0755 / Users / angeloliao / Documents。 It ran. 跑了

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8">
</head>
<body>
   <form enctype="multipart/form-data" method="POST">
       <input type="file" name="file" />
       <input type="submit" name="submit" value="upload" />
   </form>
   <?php
   if ($_FILES) {
       $name = $_FILES['file']['name'];
       $temp = $_FILES['file']['tmp_name'];
       $dir = "/Users/angeloliao/Documents/";
   if (move_uploaded_file($temp,$dir.$name)) {
       echo "File is valid, and was successfully uploaded.\n";
     }
     } else {
         echo "Possible file upload attack!\n";
   }
   ?>
</html>

Answer 1

<!DOCTYPE html>
<html>
   <head>
    <meta charset="UTF-8">
</head>
<body>
    <form enctype="multipart/form-data" method="POST">
        <input type="file" name="file" />
        <input type="submit" name="submit" value="upload" />
    </form>
    <?php
        $name = $_FILES['file']['name'];
        $temp = $_FILES['file']['tmp_name'];
        $dir = "/Users/1/Documents/";
        move_uploaded_file($temp,$dir.$name);
    ?>
</body>

Should be a _ not + and the directory should be "Documents/" WITH a slash 应该是_而不是+，目录应该是带有斜线的“ Documents /”

Answer 2

As per the PHP documentation , the temporary name is found in $_FILES['file']['tmp_name'] not $_FILES['file']['tmp+name'] . 根据PHP文档，临时名称位于$_FILES['file']['tmp_name']而非$_FILES['file']['tmp+name'] 。 Also, do a var_dump() of $dir.$name . 另外，执行$dir.$name的var_dump() 。 If the file you uploaded is "image.jpg" then it would be /Users/1/Documentsimage.jpg . 如果您上传的文件是“ image.jpg”，那么它将是/Users/1/Documentsimage.jpg 。 Notice the missing slash. 注意缺少的斜杠。

Changing this will make your code work, but it still doesn't handle all possible errors nor is it secure! 更改此设置将使您的代码正常工作，但仍不能处理所有可能的错误，也不安全！ Uploads can fail. 上载可能会失败。 If they do, you will find an error code ( the docs has a reference that lists them all ) in $_FILES['file']['error'] . 如果这样做，您会在$_FILES['file']['error']找到错误代码（文档中有列出所有参考的参考）。 You should check that the uploaded succeeded before moving the temporary file (and you should also only execute the move command if the form has been submitted). 在移动临时文件之前，您应该检查上载是否成功（如果提交了表单，还应该只执行move命令）。

In addition, it is not secure to use the name provided by the uploader. 此外，使用上传者提供的名称并不安全。 Consider if the $_FILE['file']['name'] was ../../../usr/local/bin/php . 考虑$_FILE['file']['name']为../../../usr/local/bin/php 。 Then the uploader could replace your PHP interpreter with a malicious executable. 然后，上传程序可以用恶意可执行文件替换您的PHP解释器。 This is dangerous! 这很危险！ Never trust user input! 永远不要相信用户的输入！ In this case, the best practice is to randomly generate a filename which is not dependent on the original filename (ie. don't just hash the provided filename, because what if two people upload a file with a same name?). 在这种情况下，最佳做法是随机生成一个文件名，该文件名不依赖于原始文件名（即，不要仅散列提供的文件名，因为如果两个人上传同名文件怎么办？）。

if($_POST['submit'] === 'upload') {  // only process form if it has been submitted

    if($_FILES['file']['error'] !== UPLOAD_ERR_OK) {

        exit('There was an error uploading your file');
    }

    $uploads_dir = '/Users/1/Documents/';
    $upload_name = sha1(mt_rand().microtime(true)); // you should actually pick
                                                    // something more unique
                                                    // (collisions are possible)

    move_uploaded_file($FILES['file']['tmp_name'], $uploads_dir . $upload_name);
}

无法使用PHP上传文件？

问题描述

2 个解决方案

解决方案1
3 2014-07-10 23:48:22

解决方案2
0 2014-07-11 00:04:56

无法使用PHP上传文件？

问题描述

2 个解决方案

解决方案1 3 2014-07-10 23:48:22

解决方案2 0 2014-07-11 00:04:56

解决方案1
3 2014-07-10 23:48:22

解决方案2
0 2014-07-11 00:04:56