將PHP重命名爲字段條目

我試圖實現提交系統，人們可以在其中填寫個人信息並附加文件上傳。他們的信息應該被記錄到MySQL數據庫中，並且該文件應該被重命名爲其中一個字段，然後是擴展名。以下是我迄今爲止..將PHP重命名爲字段條目

這是表單頁面：

<html> 
<head> 
<title>Submissions Script DEV</title> 
<style type="text/css"> 
/**** Start page styles ****/ 

body { 
    background: #DFA01B; 
    font-family: arial, sans-serif; 
    font-size: 14px; 
    } 

#wrap { 
    max-width: 600px; 
    margin: 30px auto; 
    background: #fff; 
    border: 4px solid #FFD16F; 
    -moz-border-radius: 15px; 
    -webkit-border-radius: 15px; 
    border-radius: 15px; 
    padding: 20px; 
    } 
</style> 
<body> 
<div id="wrap"> 
    <div align="center"> 
    <a href="http://siteurl.com"><img src="logo.png" /> </a> 
    <h1 style="font-family:arial">Submissions</h1> 
    <p style="font-family:helvetica"> <i> Welcome to the submission page</i> </p> 
</div> 
<form method="POST" action="upload.php" enctype="multipart/form-data"> 
    <p> 
       Please enter your first name: <input type="text" name = "fname"> 
      <p> 
       Please enter your last name: <input type="text" name= "lname"> 
      <p> 
       Student #: <input type="text" name= "snumber"/> 
      <p> 
      Grade: <select name= "grade"> 
      <option>9</option> 
      <option>10</option> 
      <option>11</option> 
      <option>12</option> 
     </select> 
     <p> 
<hr> 
      <!---Upload file section begins---> 
       Please attach your Powerpoint (ppt/pptx/zip) file. The file should be  named student#.zip. (For example; 123456.ppt) 
     </p> 
     <input type="hidden" name="size" value="1024000"> 
      <input type="file" name="upload"> 

     <p> 
     <br/> 
     <br/> 
     <div align="center"> 
     <input type=button onClick="location.href='instructions.html'" value='Back'> 
     <input TYPE="submit" name="upload" title="Send your submission" value="Submit Portfolio"/> 
     </div> 
     </form> 
<p> 
<!---Footer Styling---> 
<div style="font-family: Arial; 
font-size: 10px; 
color: grey; 
align: center;"> 
<!---Footer Contents---> 
    <p>Copyright <a href="http://sitename.com">site</a>site</p> 
</div> 
</div> 
</body> 
</html>

這是upload.php的：

<?php 

//This is the directory where images will be saved 
$target = "uploads/"; 
$target = $target . basename($_FILES['upload']['name']); 

//This gets all the other information from the form 
$fname=$_POST['fname']; 
$lname=$_POST['lname']; 
$upload=($_FILES['upload']['name']); 
$snumber=$_POST['snumber']; 
$grade=$_POST['grade']; 

// Connects to your Database 
mysql_connect("localhost", "db_user", "dbuserpass") or die(mysql_error()) ; 
mysql_select_db("sub-data") or die(mysql_error()) ; 

//Writes the information to the database 
mysql_query("INSERT INTO `Submissions` VALUES ('$fname', '$lname', '$snumber', '$grade',   '$upload')") ; 

//Writes the upload to the server 
if(move_uploaded_file($_FILES['upload']['tmp_name'], $target)) 
{ 

//Tells you if its all ok 
echo "The file ". basename($_FILES['uploadedfile']['name']). " has been uploaded, and your information has been recorded"; 
} 
else { 

//Gives and error if its not 
echo "Sorry, there was a problem uploading your file."; 
} 
?>

最後，我希望用snumber字段從表單中命名爲文件上傳。例如，如果有人在snumber字段中填寫12345並上傳.zip文件，它應自動重命名爲12345.zip並存儲在相應的目錄中。

我該怎麼做呢？我對PHP很陌生，但是我已經做了一些關於這個問題的研究，雖然我沒有找到任何適合這個需求的東西。

來源

2011-10-11 Ved Petkar

爲什麼你不只是更新'$ target'？ –

你是什麼意思？對不起，這真是新鮮事。 –

看起來你已經在你的應用程序中寫入了一些[SQL Injection]（http://en.wikipedia.org/wiki/SQL_injection）漏洞。我建議學習如何使用[PHP的準備語句]（http://php.net/manual/en/pdo.prepared-statements.php），這使得編寫數據庫代碼對您和您的用戶來說更安全。另外，你可能寫了一個[目錄遍歷漏洞]（http://en.wikipedia.org/wiki/Directory_traversal_attack），因爲在這裏我沒有看到任何文件名消毒。（也許它在'move_uploaded_file（）'？） – sarnold

只需使用目標文件名的值更新$target變量即可。例如，更改

$target = "uploads/"; 
$target = $target . basename($_FILES['upload']['name']); 
if(move_uploaded_file($_FILES['upload']['tmp_name'], $target))

到

$extension = explode(".", $_FILES['upload']['name']); 
$extension = $extension[count($extension)-1]; 
$target = "uploads/"; 
$target = $target . $_POST['snumber'] . "." . $extension; 
if(move_uploaded_file($_FILES['upload']['tmp_name'], $target))

來源

2011-10-12 01:37:48

完美！有效。 P.S.還有一個問題涉及到整個系統[這裏]（http://stackoverflow.com/questions/7509132/need-php-upload-form-to-sort-files-into-sub-directory-based-upon-落下）。任何輸入也讚賞這個問題！ –

將PHP重命名爲字段條目

回答

相關問題