PHP文件上传的具体思路及实现

首先是我们预设的变量值，它包括文件大小，文件扩展名类型，mimi类型，及是否删除的开关变量

$max_size = 2000000;
$file_mimes = array('image/jpeg','image/jpg','image/gif'
                   ,'image/png','application/msword');

$file_exts  = array('.zip','.jpg','.png','.gif');

$deletable  = true;                              

下一部就是设置浏览器访问变量及目录访问变量：

$site_name = $_server['http_host'];
$url_dir = "http://".$_server['http_host'].dirname($_server['php_self']);
$url_this =  "http://".$_server['http_host'].$_server['php_self'];

$upload_dir = "files/";
$upload_url = $url_dir."/files/";
$message ="";

建立上传目录并相应改变权限：

if (!is_dir("files")) {
  if (!mkdir($upload_dir))
   die ("upload_files directory doesn't exist and creation failed");
  if (!chmod($upload_dir,0755))
   die ("change permission to 755 failed.");
}

用户请求的处理：

if ($_request[del] && $deletable)  {
  $resource = fopen("log.txt","a");
  fwrite($resource,date("ymd h:i:s")."delete - $_server[remote_addr]"."$_request[del]/n");
  fclose($resource);
 
  if (strpos($_request[del],"/.")>0);                  //possible hacking
  else if (strpos($_request[del],"files/") === false); //possible hacking
  else if (substr($_request[del],0,6)=="files/") {
    unlink($_request[del]);
    print "<script>window.location.href='$url_this?message=deleted successfully'</script>";
  }
}
else if ($_files['userfile']) {
  $resource = fopen("log.txt","a");
  fwrite($resource,date("ymd h:i:s")."upload - $_server[remote_addr]"
            .$_files['userfile']['name']." "
            .$_files['userfile']['type']."/n");
  fclose($resource);

$file_type = $_files['userfile']['type'];
  $file_name = $_files['userfile']['name'];
  $file_ext = strtolower(substr($file_name,strrpos($file_name,".")));

  //文件大小的检查：

  if ( $_files['userfile']['size'] > $max_size)
     $message = "the file size is over 2mb.";
  //file type/extension check
  else if (!in_array($file_type, $file_mimes)
          && !in_array($file_ext, $file_exts) )
     $message = "sorry, $file_name($file_type) is not allowed to be uploaded.";
  else
     $message = do_upload($upload_dir, $upload_url);
 
  print "<script>window.location.href='$url_this?message=$message'</script>";
}
else if (!$_files['userfile']);
else
$message = "invalid file specified.";

列出我们上传的文件：

$handle=opendir($upload_dir);
$filelist = "";
while ($file = readdir($handle)) {
   if(!is_dir($file) && !is_link($file)) {
      $filelist .= "<a href='$upload_dir$file'>".$file."</a>";
      if ($deletable)
        $filelist .= " <a href='?del=$upload_dir$file' title='delete'>x</a>";
      $filelist .= "_{<small><small><font color=grey>  ".date("d-m h:i", filemtime($upload_dir.$file))
                   ."</font></small></small>}";
      $filelist .="<br>";
   }
}

function do_upload($upload_dir, $upload_url) {

$temp_name = $_files['userfile']['tmp_name'];
$file_name = $_files['userfile']['name'];
  $file_name = str_replace("//","",$file_name);
  $file_name = str_replace("'","",$file_name);
$file_path = $upload_dir.$file_name;

//file name check
  if ( $file_name =="") {
   $message = "invalid file name specified";
   return $message;
  }

  $result  =  move_uploaded_file($temp_name, $file_path);
  if (!chmod($file_path,0777))
    $message = "change permission to 777 failed.";
  else
    $message = ($result)?"$file_name uploaded successfully." :
            "somthing is wrong with uploading a file.";
  return $message;
}

?>