Recommend Me a Simple PHP Image Upload Script

[accelerator]

Tweet

Hi All

Can anyone recommend me a simple PHP image upload script? It just needs to be able to upload one image to a particular folder on my server, I don't need anything particularly fancy, just looking for a best practice script.

Thanks

[Andrew Starr]

something like this should work

<form enctype="multipart/form-data" action="image-upload.php" method="POST">
<fieldset>
<input name="theimage" type="file" />
<input type="submit" value="Upload" />
</fieldset>
</form>

and then in image-upload.php

$target_path = "/home/ACCOUNTNAME/public_html/images/";

$target_path = $target_path . basename( $_FILES['theimage']['name']);

if(move_uploaded_file($_FILES['theimage']['tmp_name'], $target_path)) {
echo "<p>The image ".  basename( $_FILES['theimage']['name']). " has been uploaded</p>";
} else{
echo "<p>There was an error uploading the image, please try again!</p>";
} 

[accelerator]

Thanks for that.

Rgds

[a4uDarian]

As far as I can see there's nothing in that script to stop people uploading executable scripts - and as you're moving the file to a place that is publicly accessible I would by very careful using this without some form of extra validation in place (to check the file really is a harmless image).

More here: make upload file (move_uploaded_file) secure for public usage - CodingForums.com

[Andrew Starr]

Of course, but accelerator was only asking for something quick & simple. I just assumed that he wanted to use it as a one-off

[a4uDarian]

Yeh indeed, the warning was mostly for future people who may not know better yet. I can imagine someone simply copy pasting, it working and then them not thinking any more about it. Mostly from experience

[accelerator]

I'm using it in the admin section of my site, behind htaccess password protection, so it should be ok. Thanks for your concern though.

Rgds