This article mainly introduces the PHP move_uploaded_file() function, which actually moves the uploaded file to a new location. Friends who need it can refer to the

Definition and usage

move_uploaded_file() Function moves the uploaded file to a new location.

If successful, return true, otherwise return false.

Syntax

move_uploaded_file(file,newloc)

##ParametersDescriptionfileRequired. Specifies the files to be moved. newlocRequired. Specifies the new location of the file. Explanation

This function checks and ensures that the file specified by file is a legal upload file (that is, uploaded through PHP's HTTP POST upload mechanism) . If the file is legal, it is moved to the file specified by newloc.

If file is not a legal uploaded file, no operation will occur and move_uploaded_file() will return false.

If file is a legal uploaded file but cannot be moved for some reason, no action will occur and move_uploaded_file() will return false and a warning will be issued.

This kind of check is particularly important if the uploaded file may cause its content to be displayed to the user or other users of this system.

Tips and Notes

Note: This function is only used for files uploaded via HTTP POST.

Note: If the target file already exists, it will be overwritten.

Security Supplement

Introduction from w3c, let’s talk about the problems I encountered.

Generally speaking, we will write the save file like this:

$fileName = $_SERVER['DOCUMENT_ROOT'].'/Basic/uploads/'.$_FILES['file']['name']; 
move_uploaded_file($_FILES['file']['tmp_name'],$fileName )

First explain, the meaning of these two codes: save the file directly, and the file name is also the file name uploaded by the user

Okay, now the risk is here:

①Save the file directly.

This means that the file will not be identified in any way. If a user uploads a piece of background code and saves it as a jpg suffix or other, if the administrator accidentally maps it to php and then accesses the background, - - Result It is conceivable that if he deletes all databases in the background, the entire website will directly GG. In short, saving files directly is very risky.

②Use the same file name as the user file name.

The above code will report an error if the user uses a Chinese file name.

As soon as the file name is involved, encoding is involved. If the file name is an English number, it is fine. If it contains Chinese characters, it will be a big problem and it must be re-encoded.

I think reliable storage should be like this:

①The files uploaded by users must be identified.

File recognition, this part has many functions. I think it is good to use MIME type, which is also difficult to forge.

② Change the file name.

I think it’s best to change the file name to a time format like “201803264104421”, or you can also correspond the file name to the database.

Supplement:

There are two parameters. The first parameter is the temporary file name after you upload it, which is automatically generated by the system. Usually the style is:

$_FILE["file"]["tmp_name"];

where file is the name of your front-end file upload form.

The second parameter is the new file name containing the path. For example:

"upload/1.jpg";

In this way, the file you uploaded will be moved to the subdirectory named upload in the current directory, and the file name will be saved as :1.jpg.

move_uploaded_file() function example

Use the move_uploaded_file() function to upload files to the server.

<?php
  $tmp_filename = $_FILES[&#39;myupload&#39;][&#39;tmp_name&#39;];
  if(!move_uploaded_file($tmp_filename,"/path/to/dest/{$_FILES[&#39;myupload&#39;][&#39;name&#39;]}")) {
   echo "An error has occurred moving the uploaded file.<BR>";
   echo "Please ensure that if safe_mode is on that the " . "UID PHP is using matches the file.";
   exit;
  } else {
   echo "The file has been successfully uploaded!";
  }
?>

move_uploaded_file File upload failure case and solution

Today, when implementing a PHP script that uploads an avatar image file when a user registers, a problem occurred: php The script code is as follows:

<?php 
define(&#39;ROOT&#39;,dirname(__FILE__).&#39;/&#39;); 
 if ($_FILES["file"]["error"] > 0) 
 { 
  echo "Return Code: " . $_FILES["file"]["error"] . "<br />"; 
 } 
 else 
 { 
  echo "Upload: " . $_FILES["file"]["name"] . "<br />"; 
  echo "Type: " . $_FILES["file"]["type"] . "<br />"; 
  echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />"; 
  echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />"; 
  if (file_exists("upload/" . $_FILES["file"]["name"])) 
  { 
   echo $_FILES["file"]["name"] . " already exists. "; 
  } 
  else 
  { 
   if(is_uploaded_file($_FILES[&#39;file&#39;][&#39;tmp_name&#39;])){ 
    $stored_path = ROOT.&#39;/upload/&#39;.basename($_FILES[&#39;file&#39;][&#39;name&#39;]); 
     
    if(move_uploaded_file($_FILES[&#39;file&#39;][&#39;tmp_name&#39;],$stored_path)){ 
     echo "Stored in: " . $stored_path; 
    }else{ 
     echo &#39;Stored failed:file save error&#39;; 
    } 
   }else{ 
    echo &#39;Stored failed:no post &#39;; 
   } 
   } 
 } 
?>

When I execute the above script, the script outputs "Stored failed: file save error", which is obviously an error. In the php_error_log file, I saw the error problem: insufficient permissions, I finally found what went wrong: the destination directory where we store the pictures does not have permissions for the user who executes the PHP script. The user who executes the PHP script is not the same user who wrote the script code and created the picture folder, so only You need to change the file permissions to 777.

PHP Development Learning File Upload (move_uploaded_file)

Function: Move the uploaded temporary file to the upload directory. Upload has been created in the root directory! ! !

<form action="" enctype="multipart/form-data" method="post" 
  name="uploadfile">上傳文件：<input type="file" name="upfile" /><br> 
 <input type="submit" value="上傳" /></form> 
<?php 
//print_r($_FILES["upfile"]); 
if(is_uploaded_file($_FILES[&#39;upfile&#39;][&#39;tmp_name&#39;])){ 
 $upfile=$_FILES["upfile"]; 
//獲取數(shù)組里面的值 
 $name=$upfile["name"];//上傳文件的文件名 
 $type=$upfile["type"];//上傳文件的類型 
 $size=$upfile["size"];//上傳文件的大小 
 $tmp_name=$upfile["tmp_name"];//上傳文件的臨時存放路徑 
//判斷是否為圖片 
 switch ($type){ 
  case &#39;image/pjpeg&#39;:$okType=true; 
   break; 
  case &#39;image/jpeg&#39;:$okType=true; 
   break; 
  case &#39;image/gif&#39;:$okType=true; 
   break; 
  case &#39;image/png&#39;:$okType=true; 
   break; 
 } 
 
 if($okType){ 
  /** 
   * 0:文件上傳成功<br/> 
   * 1：超過了文件大小，在php.ini文件中設(shè)置<br/> 
   * 2：超過了文件的大小MAX_FILE_SIZE選項指定的值<br/> 
   * 3：文件只有部分被上傳<br/> 
   * 4：沒有文件被上傳<br/> 
   * 5：上傳文件大小為0 
   */ 
  $error=$upfile["error"];//上傳后系統(tǒng)返回的值 
  echo "================<br/>"; 
  echo "上傳文件名稱是：".$name."<br/>"; 
  echo "上傳文件類型是：".$type."<br/>"; 
  echo "上傳文件大小是：".$size."<br/>"; 
  echo "上傳后系統(tǒng)返回的值是：".$error."<br/>"; 
  echo "上傳文件的臨時存放路徑是：".$tmp_name."<br/>"; 
 
  echo "開始移動上傳文件<br/>"; 
//把上傳的臨時文件移動到upload目錄下面(upload是在根目錄下已經(jīng)創(chuàng)建好的?。。? 
  move_uploaded_file($tmp_name,"upload/".$name); 
  $destination="upload/".$name; 
  echo "================<br/>"; 
  echo "上傳信息：<br/>"; 
  if($error==0){ 
   echo "文件上傳成功啦！"; 
   echo "<br>圖片預(yù)覽:<br>"; 
   echo "<img src=".$destination.">"; 
//echo " alt=\"圖片預(yù)覽:\r文件名:".$destination."\r上傳時間:\">"; 
  }elseif ($error==1){ 
   echo "超過了文件大小，在php.ini文件中設(shè)置"; 
  }elseif ($error==2){ 
   echo "超過了文件的大小MAX_FILE_SIZE選項指定的值"; 
  }elseif ($error==3){ 
   echo "文件只有部分被上傳"; 
  }elseif ($error==4){ 
   echo "沒有文件被上傳"; 
  }else{ 
   echo "上傳文件大小為0"; 
  } 
 }else{ 
  echo "請上傳jpg,gif,png等格式的圖片！"; 
 } 
} 
?>

Execution results:

The above is the entire content of this article. I hope it will be helpful to everyone’s study. For more related content, please pay attention to the PHP Chinese website !

Related recommendations:

The difference between the constructor _construct() and _initialize() of the class in ThinkPHP

How to use distinct in Thinkphp

The above is the detailed content of move_uploaded_file() function in PHP. For more information, please follow other related articles on the PHP Chinese website!