图像上传PHP的问题

Question

I'm trying to create a form where users can select an image and set their profile picture. After this I want to get this specific information and display it within HTML.

I have the following code inside profile.php;

if(isset($_POST['submit']) ){
    $fileName = $_FILES["avatar"]["name"];
    $fileTmpLoc = $_FILES["avatar"]["tmp_name"];
    $fileType = $_FILES["avatar"]["type"];
    $fileSize = $_FILES["avatar"]["size"];
    $fileErrorMsg = $_FILES["avatar"]["error"];
    $mysql->setUserAvatar($fileName, $fileTmpLoc, $fileType, $fileSize, $fileErrorMsg, $s_email);
}

I have the following code inside mysql.php (this code is inside a class name mysql):

function setUserAvatar($fileName, $fileTmpLoc, $fileType, $fileSize, $fileErrorMsg, $s_email){

    $kaboom = explode(".", $fileName);
    $fileExt = end($kaboom);

    list($width, $height) = getimagesize($fileTmpLoc);

    if($width < 10 || $height < 10){
        echo "Image is too small";
        exit(); 
    }

    $db_file_name = rand(100000000000,999999999999) . "." . $fileExt;
    echo $db_file_name;

    if($fileSize > 1048576) {
        echo "Image can't be larger than 1MB";
        exit(); 
    } else if (!preg_match("/\.(gif|jpg|png)$/i", $fileName) ) {
        echo "The file extension should be .gif, .jpg or .png";
        exit();
    } else if ($fileErrorMsg == 1) {
        echo "An unknown error occurred";
        exit();
    }

    $sql = "SELECT avatar FROM users WHERE email='$s_email' LIMIT 1";

    $query = mysqli_query($this->db, $sql);
    $row = mysqli_fetch_row($query);

    $avatar = $row[0];

    if($avatar != ""){
        $picurl = "../user/$s_email/$avatar"; 
        if (file_exists($picurl)) { unlink($picurl); }
    } 

    $moveResult = move_uploaded_file($fileTmpLoc, SITE_ROOT . "/../user/$s_email/". $db_file_name);

    if ($moveResult != true) {
        echo "File upload failed";
        exit();
    }

    $sql = "UPDATE users SET avatar='$db_file_name' WHERE email='$s_email' LIMIT 1";
    $query = mysqli_query($this->db, $sql);

}

After this is done, I want to do something like:

<img src="user/" . $s_email . "/" . $data['avatar'] . " />

How ever, when I try to reach the avatar element from the MySQL database, I always get the same number, which is: 2147483647 (but in the user folder everything went right). So there is a problem with the value that is getting inserted into the database. Any suggestions what this problem might be?

EDIT: I've fixed the issue by decreasing the length of the random number. However, the problem is still that the value in the database hasn't receive the extension? The column datatype of avatar is VARCHAR.

It's this line:

$db_file_name = rand(100000,999999) . "." . $fileExt;

Answer 1

Yes, a nice feature of most random number generators is that they produce repeatable results unless you tell them not to.

In the case of PHP you tell it not to start at the same place using srand()

Answer 2

Your number is to big. and not very random.

$db_file_name = rand(100000000000,999999999999) 

Your min and max are very close to each other/in wrong order, and to large because the number your getting 2147483647 = 2^30 -1 is most likely the size limit for the type of column input you decided to use for the name.

rand documentation http://php.net/manual/en/function.rand.php

Change your column type to something like varchar(40)

I'd also recommend not using random numbers greater than php's signed 32 bit integer rand(0,2147483647);