提交给自己时防止执行PHP脚本

Question

I have this form:

<form name="commentform" id="commentform" action="comment.php" method="post" 
enctype="multipart/form-data">

Your Name: 
<textarea maxlength="60" rows="1" cols="62" class="margin" name="name" 
id="name"> </textarea> <br><br>

Submit Picture
<input type="file" name="pic" id="pic" /> <br><br>

<input type="Submit" value="Submit" />
</form>

This is the PHP to validate the picture (from W3Schools.com):

<?php
if ((($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/pjpeg"))
&& ($_FILES["file"]["size"] < 20000))
{
if ($_FILES["file"]["error"] > 0)
{
echo "Return Code: " . $_FILES["file"]["error"] . "<br />";
}
else
{
echo "Upload: " . $_FILES["file"]["name"] . "<br />";
echo "Type: " . $_FILES["file"]["type"] . "<br />";
echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />";

if (file_exists("upload/" . $_FILES["file"]["name"]))
  {
  echo $_FILES["file"]["name"] . " already exists. ";
  }
else
  {
  move_uploaded_file($_FILES["file"]["tmp_name"],
  "upload/" . $_FILES["file"]["name"]);
  echo "Stored in: " . "upload/" . $_FILES["file"]["name"];
  }
  }
  }
  else
  {
  echo "Invalid file";
  }
  ?>

I am the submitting the form to the same page, so the PHP is executed as soon as the webpage loads. How can I make it load as soon as the form is submitted? Also, this script does not seem to be working.

Answer 1

You need to check if your form is submitted before you process the file upload:

if ( isset($_POST['pic'])) {

  //save file here.

}

EDIT: It looks like your not referring to the right POST variable - you have a file element called 'pic' in your form but you are referring to $_POST['file'] in your PHP code which will not exist.

Also: If you are starting out with PHP, (IMHO) W3Schools.com is the worse place you can be - I've seen really bad examples of how code should NOT be written in there..

Answer 2

<?php

if( isset( $_POST( 'submit' ) ) ){ // Check form is submitted or not 

if ((($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/pjpeg"))
&& ($_FILES["file"]["size"] < 20000))
{
if ($_FILES["file"]["error"] > 0)
{
echo "Return Code: " . $_FILES["file"]["error"] . "<br />";
}
else
{
echo "Upload: " . $_FILES["file"]["name"] . "<br />";
echo "Type: " . $_FILES["file"]["type"] . "<br />";
echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />";

if (file_exists("upload/" . $_FILES["file"]["name"]))
  {
  echo $_FILES["file"]["name"] . " already exists. ";
  }
else
  {
  move_uploaded_file($_FILES["file"]["tmp_name"],
  "upload/" . $_FILES["file"]["name"]);
  echo "Stored in: " . "upload/" . $_FILES["file"]["name"];
  }
  }
  }
  else
  {
  echo "Invalid file";
  }
}
  ?>

Answer 3

Add This To the Top of your page:

<?php $action = $_GET['action']; ?>

Your New Form:

<form name="commentform" id="commentform" action="comment.php?action=go" method="post" enctype="multipart/form-data">
Your Name: <textarea maxlength="60" rows="1" cols="62" class="margin" name="name" id="name"> </textarea> <br><br>

Submit Picture<input type="file" name="pic" id="pic" /> <br><br>
<input type="Submit" value="Submit" />
</form>

And the action script:

<?php
if (isset($action) && $action == 'go'){
if ((($_FILES["file"]["type"] == "image/gif") || ($_FILES["file"]["type"] == "image/jpeg") || ($_FILES["file"]["type"] == "image/pjpeg")) && ($_FILES["file"]["size"] < 20000)) {
if ($_FILES["file"]["error"] > 0){
echo "Return Code: " . $_FILES["file"]["error"] . "<br />";
}else{
echo "Upload: " . $_FILES["file"]["name"] . "<br />";
echo "Type: " . $_FILES["file"]["type"] . "<br />";
echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />";
echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />";
if (file_exists("upload/" . $_FILES["file"]["name"]))  {
echo $_FILES["file"]["name"] . " already exists. ";  
}else{  
move_uploaded_file($_FILES["file"]["tmp_name"],  "upload/" . $_FILES["file"]["name"]);  
echo "Stored in: " . "upload/" . $_FILES["file"]["name"];  
}  
}  
}else{  
echo "Invalid file";  
}  
}
?>