防止通過表單覆蓋文件上傳和MySQL記錄？

我有一個提交系統設置，我想要它，所以沒有重複的條目可以提交。如果提交了一個，原始記錄和文件上傳被保留（不被覆蓋）。此外，如果存在，我希望表單向用戶顯示錯誤。這是我的upload.php（在HTML表單中提到）。防止通過表單覆蓋文件上傳和MySQL記錄？

upload.php的

<?php 

//This is the directory where images will be saved 
$extension = explode(".", $_FILES['upload']['name']); 
$extension = $extension[count($extension)-1]; 
$target = "uploads/"; 
$target = $target . $_POST['snumber'] . "." . $extension; 

//This gets all the other information from the form and prevents SQL injection 
$fname=$_POST['fname']; 
$lname=$_POST['lname']; 
$upload=($_FILES['upload']['name']); 
$snumber=$_POST['snumber']; 
$grade=$_POST['grade']; 
$email=$_POST['email']; 

// Connects to your Database 
mysql_connect("localhost", "db_user", "password") or die(mysql_error()) ; 
mysql_select_db("db_name") or die(mysql_error()) ; 

//Writes the information to the database 
mysql_query("INSERT INTO `Table` VALUES ('$fname', '$lname', '$snumber', '$grade', '$email', '$target')") ; 

//Writes the upload to the server 
if(move_uploaded_file($_FILES['upload']['tmp_name'], $target)) 
{ 
//Tells you if its all ok 
echo "Your submission ". basename($_FILES['uploadedfile']['name']). " was successful and we have received your submission. Your result will be sent to $email "; 
} 
else { 

//Gives and error if its not 
echo "Sorry, there was a problem uploading your file."; 
} 
?>

我怎麼會去這樣做呢？

編輯：從下面結合的建議，這裏是更新的代碼但現在我得到一個Parse error: syntax error, unexpected T_ECHO in /path/to/upload.php on line 32

新upload.php的

<?php 

//This is the directory where images will be saved 
$extension = explode(".", $_FILES['upload']['name']); 
$extension = $extension[count($extension)-1]; 
$target = "uploads/"; 
$target = $target . $_POST['snumber'] . "." . $extension; 

//This gets all the other information from the form and prevents SQL injection 
$fname=$_POST['fname']; 
$lname=$_POST['lname']; 
$upload=($_FILES['upload']['name']); 
$snumber=$_POST['snumber']; 
$grade=$_POST['grade']; 
$email=$_POST['email']; 

//Checks if submission already exists 
if(file_exists($target)) 
{ 
    echo "This submission already exists. Please check that you have entered all values correctly. If this is an error please contact support"; 
} 
else 
{ 
    //Now that file doesn't exist, move it. 
    move_uploaded_file($_FILES['upload']['tmp_name'], $target); 
    //MYSQL CONNECTION 
     mysql_connect("localhost", "db_user", "password") or die(mysql_error()) ; 
     mysql_select_db("db_name") or die(mysql_error()) ; 
    //MYSQL Entry 
     mysql_query("INSERT INTO Table (fname, lname, snumber, grade, email, target) VALUES ('".mysql_real_escape_string($fname)."', '".mysql_real_escape_string($lname)."', '".mysql_real_escape_string($snumber)."', '".mysql_real_escape_string($grade)."', '".mysql_real_escape_string($email)."', '".mysql_real_escape_string($target)."')") 

    echo "Your submission was successful and we have received your portfolio. Your marks will be sent out to $email."; 
} 
?>

來源

2011-11-02 Ved Petkar

表結構是什麼樣的？ –

是的，插入就像是壞主意。如果通過在中間的某個位置添加一列來修改表，則會破壞此查詢。例如，如果您想收集中間首字母，您可以將該列放在fname和lname之間。然後查詢失敗。應該是（「INSERT INTO表」（'fname'，'lname'，'snumber'，'grade'，'email'，'target'）VALUES（'「.mysql_real_escape_string（$ fname）。」'，'「 .mysql_real_escape_string（$ lname）。「'，'」.mysql_real_escape_string（$ snumber）。「'，'」.mysql_real_escape_string（$ grade）。「'，'」.mysql_real_escape_string（$ email）。「'，'」.mysql_real_escape_string （$ target）。「'）」） –

將其添加到原始代碼中，但獲取SYNTAX錯誤。 –

看起來你存儲在數據庫中的目標，所以您可以檢查數據庫以查看該文件是否已經存在，或者您可以使用php的file_exists（）函數。

DB你顯然在插入語句之前運行查詢，並使你的條件基於結果。

否則，

if(file_exists($target)) 
{ 
    echo 'error'; 
} 
else 
{ 
    move_uploaded_file($_FILES['upload']['tmp_name'], $target); 
    // do success things here 
}

文件存在，則可能需要完整路徑。如果它不能馬上工作，看看$ _SERVER ['DOCUMENT_ROOT']是否有幫助。

來源

2011-11-02 02:09:43

然後在'else'的情況下執行'INSERT'，否則你會在數據庫中插入記錄兩次 –

我看到了，所以在放置INSERT後）into else case，it will only add the row AFTER the file exists check check done？ –

@VedPetkar最好的方法是驗證'move_uploaded_file'是否成功，如果'move_uploaded_file'返回TRUE，則添加到數據庫。 –

我已經提交表單和

var param = "action=testfile&dirpath=" + dirpath + "&file=" + filename; 

    $.ajax({ 
     type: "GET", 
     url: 'combi/testfile.php', 
     data: param, 
     success: function(data) { 
      test data .... if OK submit. 
     }

在testfile.php您測試的文件和文件之前將一個Ajax查詢解決這個問題回聲出數據

if($_GET['action'] == 'testfile'){ 
    $msg = ''; 
    $basedirpath = $_GET['dirpath'] . "/"; 

    if(file_exists($basedirpath . $_GET['file'])) { 
     $msg = 'exists'; 
    } 
    echo $msg; 
}

$ msg是在ajax調用中的數據中返回的。

來源

2012-02-08 07:17:16 Daniel

防止通過表單覆蓋文件上傳和MySQL記錄？

回答

相關問題