Home > Tutorials > PHP Tutorials > PHP/MySQL File Upload – Error Checking

PHP/MySQL File Upload – Error Checking

A while back I had written a PHP/MySQL tutorial discussing how to upload an image to your server, and store the information about that uploaded image into your MySQL database. That tutorial covered really only the basics, and I knew that eventually someone would post a comment asking about some more advanced features – such as limiting the file size of uploaded images, as requested by Evaleen Tan. So this tutorial aims to expand upon the basic file upload functionality that was discussed previously and introduce various error checking features for file size, and file types, etc.

Now, let’s quickly recap where we left off in the last tutorial. We have built our basic HTML form, which requests for the users username, password, and provides an avatar upload field. This information then gets stored into a MySQL directory. So here is our final submit.php file:

 $dbuser = "mysql_username";
 $dbpass = "mysql_password";
 $dbhost = "localhost";
 $db = "db_name";
 mysql_connect($dbhost, $dbuser, $dbpass);
 mysql_select_db($db);
 $username= trim($_POST['username']);
 $password= trim($_POST['password']);
 $avatar=($_FILES['avatar']['name']);
 $target = "avatars/";
 $target = $target . basename( $_FILES['avatar']['name']);
$results = mysql_query("INSERT INTO `users` VALUES ('','$username', '$password', '$avatar')");
if(move_uploaded_file($_FILES['avatar']['tmp_name'], $target))
 {
  echo "The image ". basename( $_FILES['uploadedfile']['name']). " has been uploaded.";
  echo "<center><img alt="" src="avatars/$avatar" /></center>"
 } 
else 
 { 
echo "Sorry, there was a problem uploading your venue photo file."; 
 } 
if ($results) { 
echo "New User Has Been Added!"; 
} 
mysql_close();

So the first thing we want to add to our submit.php file are a few setting options to limit what types of files we want uploaded, and how large we want them to be. We do this by an array of extensions for our file types, and a variable  that stores the maximum allowed size of any uploaded file (in bytes).

  
$allowed_filetypes = array('.jpg','.gif','.bmp','.png'); // These will be the types of file that will pass the validation.
$max_filesize = 524288; // Maximum filesize in BYTES (currently 0.5MB).


Now that we have that information, we need to extract the extension of our uploaded file, and also figure out how large the uploaded file is. So to get the extension we utilize the PHP substring command which returns the portion of string specified by the start and length parameters and combine that with the string position command to find the position of the first occurrence of a substring in a string.

$ext = substr($avatar, strpos($avatar,'.'), strlen($avatar)-1); // Get the extension from the filename.

Now, let’s make use of the variables we have created so far and further amend our submit.php file with a few if/else statements:

$avatar=($_FILES['avatar']['name']); // Our uploaded file from the HTML form we created.
$allowed_filetypes = array('.jpg','.gif','.bmp','.png'); // These will be the types of file that will pass the validation.
$max_filesize = 524288; // Maximum filesize in BYTES (currently 0.5MB).
$ext = substr($avatar, strpos($avatar,'.'), strlen($avatar)-1); // Get the extension from the filename.

// Check if the filetype is allowed, if not DIE and inform the user.
   if(!in_array($ext,$allowed_filetypes))
      die('The file you attempted to upload is not allowed.');

   // Now check the filesize, if it is too large then DIE and inform the user.
   if(filesize($_FILES['avatar']['name']) &gt; $max_filesize)
      die('The file you attempted to upload is too large.');

Now let’s check if a file with a similar name already exists in our database. Furthermore while we’re at it we can include checks for our username as-well – since having duplicates of either one of those would likely cause some issues. Now we have already established a connection to our MySQL database, and if you need a refresher on this I do have a full tutorial written up about how to connect to a mysql database. Anyway let’s run a SELECT command for both the filename, and the username and check them against our database. We’ll start with the username:

$sql = "SELECT COUNT(*) num FROM users WHERE username = '" . mysql_real_escape_string($username) . "'";
$result = mysql_query($sql) or die('error');
$row = mysql_fetch_assoc($result);
if($row['num']) {
  die('This username already exists in the database.');
}

Now we do the same exact thing for the avatar’s filename:

$sql = "SELECT COUNT(*) num FROM users WHERE avatar = '" . mysql_real_escape_string($avatar) . "'";
$result = mysql_query($sql) or die('error');
$row = mysql_fetch_assoc($result);
if($row['num']) {
  die('An avatar with the same filename already exists in the database.');
}

So let’s combine everything now and finalize our new submit.php file:

// Connect To Our Database
 $dbuser = "mysql_username";
 $dbpass = "mysql_password";
 $dbhost = "localhost";
 $db = "db_name";
 mysql_connect($dbhost, $dbuser, $dbpass);
 mysql_select_db($db);

// Collect Information
$username= trim($_POST['username']);
$password= trim($_POST['password']);
$avatar=($_FILES['avatar']['name']); // Our uploaded file from the HTML form we created.

// Set Settings
$allowed_filetypes = array('.jpg','.gif','.bmp','.png'); // These will be the types of file that will pass the validation.
$max_filesize = 524288; // Maximum filesize in BYTES (currently 0.5MB).

$ext = substr($avatar, strpos($avatar,'.'), strlen($avatar)-1); // Get the extension from the filename.

// Check if the filetype is allowed, if not DIE and inform the user.
   if(!in_array($ext,$allowed_filetypes))
      die('The file you attempted to upload is not allowed.');

// Now check the filesize, if it is too large then DIE and inform the user.
   if(filesize($_FILES['avatar']['name']) &gt; $max_filesize)
      die('The file you attempted to upload is too large.');

// Now check for duplicate username against the database.
$sql = "SELECT COUNT(*) num FROM users WHERE username = '" . mysql_real_escape_string($username) . "'";
$result = mysql_query($sql) or die('error');
$row = mysql_fetch_assoc($result);
if($row['num']) {
  die('This username already exists in the database.');
}

// Do the same for a duplicate check against the uploaded images filename
$sql = "SELECT COUNT(*) num FROM users WHERE avatar = '" . mysql_real_escape_string($avatar) . "'";
$result = mysql_query($sql) or die('error');
$row = mysql_fetch_assoc($result);
if($row['num']) {
   die('An avatar with the same filename already exists in the database.');
}

// Specify The Target Directory for the Uploaded File
 $target = "avatars/";
 $target = $target . basename( $_FILES['avatar']['name']);

// Upload the file and run the SQL query to store all the information into the database
$results = mysql_query("INSERT INTO `users` VALUES ('','$username', '$password', '$avatar')");
if(move_uploaded_file($_FILES['avatar']['tmp_name'], $target))
 {
  echo "The image ". basename( $_FILES['uploadedfile']['name']). " has been uploaded.";
  echo "<p><center><img src="avatars/$avatar"></p></center>
 }
  else
 {
  echo "Sorry, there was a problem uploading your venue photo file.";
 }
 if ($results)
 {
  echo "<br>New User Has Been Added!";
 }
 mysql_close();

About Michael Boguslavskiy

Michael Boguslavskiy is a full-stack developer & online presence consultant based out of New York City. He's been offering freelance marketing & development services for over a decade. He currently manages Rapid Purple - and online webmaster resources center; and Media Explode - a full service marketing agency.

Check Also

5 Must Have WordPress Optimization Plugins For A Fast Loading Website

Having a fast loading website is essential these days. First off, users are impatient. If ...

  • renz

    there is error. Parse error: syntax error, unexpected ‘,’ in C:xampphtdocsrenzdaleuploading.php on line 25, i try to remove it and got another error again in line 25

    • Metalp3n

      What is on line 25 of your uploading.php file? If you can past it into a CodePen (http://codepen.io/) for me and I will diagnose it gladly.

  • marcus

    i get this error in submit.php: Parse error: syntax error, unexpected ‘;’ in C:xampphtdocsteppensubmit.php on line 26
    Line 26: if(filesize($_FILES[‘avatar’][‘name’]) > $max_filesize)

    • Metalp3n

      What’s on your Line 25?

Like every other website, this site uses cookies to analyze our traffic. Cookies may also be utilized by our advertisers and partners. By using this website you agree to the use of said cookies. More Information

The cookie settings on this website are set to "allow cookies" to give you the best browsing experience possible. If you continue to use this website without changing your cookie settings, continuing to navigate past this message, or you click "Accept" below then you are consenting to the use of cookies on the Rapid Purple website.

Close