PHP file upload using superglobal FILES array
Let's say that I am setting up a download function for a project. I am using PHP5 and I was wondering if using the $ _FILES superglobal array I could access the key of the "tmp_name" array, which is the temporary path and filename of the uploaded file, to display a preview of the image before moving it to the folder " uploads "on the server.
What I had in mind is something like this: Use jQuery to detect when an injected input file has changed (when the user selects an image file), then place an ajax call to upload the file, which will move it to the temp folder even before I I will use "move_uploaded_file". If I can somehow access the key of the "tmp_name" array, I could put it in the "img" tag to display a preview. Later, move the file to the final location when the submit button is clicked.
I am not asking for any code examples or anything else as I would love it, I just want to see if this type of array is available.
a source to share
Yes, you can.
In PHP, when a user submits a form with the $ _FILES super commutator, it is populated with useful information about the uploaded file. Inside you will find each uploaded original filename, content type, temporary upload location on the server, error code, and size in bytes.
Taken from Fixing the $ _FILES supercommulators
Here is an example of the output print_r
taken from the array website $_FILES
,
Array
(
[download_zip] => Array
(
[name] => dummy.txt
[type] => text/plain
[tmp_name] => /Applications/MAMP/tmp/php/php5TBPsw
[error] => 0
[size] => 1
)
[download_screenshot] => Array
(
[name] => dummy.txt
[type] => text/plain
[tmp_name] => /Applications/MAMP/tmp/php/phpTncd39
[error] => 0
[size] => 1
)
)
You can access it tmp_name
using the syntax $files_array['download_zip']['tmp_name']
.
Update:
$path = $files_array['download_zip']['tmp_name'];
echo "<img src='$path'>";
a source to share
To use them in an image tag, you will need to store the corresponding temp files somewhere inside the root of the website, as they are often found somewhere in the filesystem, outside of the web root, and you don't want to output that path to the user, so how it will be useless (the img tag cannot match this path) and poor security (you are passing information about your filesystem).
You can do this with a) copying each file to a location in the web root (expensive) or b) changing the configuration to put all uploaded files in temp inside the root web site (big security implications).
Keep Safe When Planning This ...
Just be careful about the safety of other temp files. Make sure that only those pertaining to this part of this application are stored inside the root of the website. You do not want you to provide enough information to allow someone to calculate access to other files and have some kind of inter-user data breach, because other uploaded data is available (even for a very short time) on your network root.
This might be the best way:
Perhaps a better solution would be to grab the temp name, obfuscate it in some way, add it to the path that will pass it to the gatekeeper file, and send it instead.
Sort of
/images/path/to/gatekeeper.png?name=[obfuscated file name here]
Then you can use /images/path/to/.htaccess to make sure the gatekeeper is treated as a php file and not a png file by adding:
<Files gatekeeper.png>
ForceType application/x-httpd-php
</Files>
Now the gatekeeper can un-obfuscate the filename, pull it out of the temporary path and send it without revealing anything to the user, moving the actual file, or changing the configuration.
Just make sure you don't expect the file to persist, because if they are updated later and the file is moved (almost certainly will) it will just be a broken image. Maybe check for existence with the gatekeeper and give them a "File is no longer available" image if not found. You can also force only image files to be sent or other security issues at the gatekeeper level.
You can do the gatekeeper like this (printed from memory probably won't work, and won't handle errors, missing values, etc., but you should use that as a starting point ...):
<?php
// This is all inside gatekeeper.png, which is just a .php file with a .png extension
// It not very good code, just an example to point you in the right direction.
// Specify this will be a png file for the browser...
header("content-type: image/png");
//Read the file name from the $_GET and un-obfuscate it.
$file = "/path/to/temp/directory/outside/file/root/that/we/hopefully/have/access/to/";
$file .= $_GET["name"];
// Check that the file exists, and send a "not found" image if not.
// http://us.php.net/manual/en/function.file-exists.php
if (!file_exists($file)) {etc...}
// Read the image file, send it to the user, and close it...
// http://us.php.net/manual/en/function.imagepng.php
$im = imagecreatefrompng($file);
imagepng($im);
imagedestroy($im);
die();
?>
a source to share