驗證上傳圖片文件PHP

Question

我要上傳文件時遇到問題，腳本對類型為jpg，png的圖像文件進行了驗證，當我成功上傳圖像文件時，但是當我嘗試上傳不同的文件類型（如doc，pdf等）時，出現通知/ alert如果文件類型錯誤，但是數據文件仍設法進入數據庫和文件夾，則僅用於宣告類型文件的腳本是錯誤的，但仍保存數據...

這是我的劇本

$image=$_FILES['upload']['name'];
$typeGambar = array('image/bmp', 'image/gif', 'image/jpg', 'image/jpeg', 'image/png');
if(!in_array($_FILES['upload']['type'][$i],$typeGambar)){ 
            echo"<meta http-equiv='refresh' content='0; url=home.php?p=product'>";
            }
$sql = mysql_query("INSERT INTO `t_product` (`id_product`,`product`,`category`,`material`,`ink`,`price`,`status`,`date`) VALUES ('$idproduct','$product','$category','$material','$ink','$price','$status',NOW());");

if ($sql) {
    $last_id = mysql_insert_id();
    foreach ($_POST['size'] as $select){
        $sql2 = mysql_query("INSERT INTO `t_productsize` (`id_product`,`id_size`) VALUES ('$last_id','$select');");
    }
    $total = count($_FILES['upload']['name']);

    // Loop through each file
    for($i=0; $i<$total; $i++) {
      //Get the temp file path
      $tmpFilePath = $_FILES['upload']['tmp_name'][$i];
      $fileError = $_FILES['upload']['error'][$i];    
      $typeGambar = array('image/bmp', 'image/gif', 'image/jpg', 'image/jpeg', 'image/png');
      if(!in_array($_FILES['upload']['type'][$i],$typeGambar)){ 
        echo'<script>
            alert("Failed insert data!!");
            </script>';
        }
        elseif($fileSize=$_FILES['gambar']['size']< 20000 || $fileError < 20000){
      //Make sure we have a filepath
      if ($tmpFilePath != ""){
        $newfilename= date('dmYHis').str_replace(" ", "", basename($_FILES["upload"]["name"]));
        //Setup our new file path
        $newFilePath = "images_product/".$newfilename . $_FILES['upload']['name'][$i];
        $nameImage = $newfilename . $_FILES['upload']['name'][$i];


        //Upload the file into the temp dir
        if(move_uploaded_file($tmpFilePath, $newFilePath)) {

          //Handle other code here
        $sql3 = mysql_query("INSERT INTO `t_productimage` (`id_product`,`image`) VALUES ('$last_id','$nameImage');");
        }
      }
    }
    }
    echo '<script>
        window.location="home.php?p=product";
        </script>';}

    else {
        echo'<script>
            alert("Failed insert data!!");
            </script>';
    }

非常感謝您的回復

Answer 1

嘗試這個

$image=$_FILES['upload']['name'];
$typeGambar = array('image/bmp', 'image/gif', 'image/jpg', 'image/jpeg', 'image/png');
if(!in_array($_FILES['upload']['type'][$i],$typeGambar)){
            echo"<meta http-equiv='refresh' content='0; url=home.php?p=product'>"; }
else {
$sql = mysql_query("INSERT INTO `t_product` (`id_product`,`product`,`category`,`material`,`ink`,`price`,`status`,`date`) VALUES ('$idproduct','$product','$category','$material','$ink','$price','$status',NOW());");

if ($sql) {

$last_id = mysql_insert_id();
foreach ($_POST['size'] as $select){
    $sql2 = mysql_query("INSERT INTO `t_productsize` (`id_product`,`id_size`) VALUES ('$last_id','$select');");
}
$total = count($_FILES['upload']['name']);

// Loop through each file
for($i=0; $i<$total; $i++) {
  //Get the temp file path
  $tmpFilePath = $_FILES['upload']['tmp_name'][$i];
  $fileError = $_FILES['upload']['error'][$i];    
  $typeGambar = array('image/bmp', 'image/gif', 'image/jpg', 'image/jpeg', 'image/png');
  if(!in_array($_FILES['upload']['type'][$i],$typeGambar)){ 
    echo'<script>
        alert("Failed insert data!!");
        </script>';
    }
    elseif($fileSize=$_FILES['gambar']['size']< 20000 || $fileError < 20000){
  //Make sure we have a filepath
  }
  else {
  if ($tmpFilePath != ""){
    $newfilename= date('dmYHis').str_replace(" ", "", basename($_FILES["upload"]["name"]));
    //Setup our new file path
    $newFilePath = "images_product/".$newfilename . $_FILES['upload']['name'][$i];
    $nameImage = $newfilename . $_FILES['upload']['name'][$i];


    //Upload the file into the temp dir
    if(move_uploaded_file($tmpFilePath, $newFilePath)) {

      //Handle other code here
    $sql3 = mysql_query("INSERT INTO `t_productimage` (`id_product`,`image`) VALUES ('$last_id','$nameImage');");
    }}
  }
}
}
echo '<script>
    window.location="home.php?p=product";
    </script>';}

else {
    echo'<script>
        alert("Failed insert data!!");
        </script>';
}}

• 注意：您在邏輯上只是錯了。