2016-08-30 103 views
0

如果你帮助我使用这个PHP代码,我会很高兴。试图确定文件类型

我做了一个上传表单只支持.pdf.docx.rtf文件。 文件被上传,但它不能确定文件类型是pdf,docx还是rtl,或者只是非文件类型。解决这个问题的任

好吧,我在stackoverflow做了一些搜索,一些成员与我做的一样,但我仍然无法正常工作。 此代码从输入中获取文件。它将文件上传到服务器,在特定文件夹上,然后将文件名保存在数据库中。

<?php 
 
    function query($q) 
 
    { 
 
    $dbconnection = mysql_connect('127.0.0.1' , 'root' , ''); 
 
    $database = mysql_select_db('hire_requests'); 
 
    mysql_set_charset("utf8",$dbconnection); 
 
    $res = mysql_query($q,$dbconnection); 
 
    mysql_close($dbconnection); 
 
    return $res; 
 
    } 
 
    function test_input($data) 
 
    { 
 
    $data = trim($data); 
 
    $data = stripslashes($data); 
 
    $data = htmlspecialchars($data); 
 
    return $data; 
 
    } 
 
    $error = ''; 
 
    $alarm = false; 
 
    $success = false; 
 
    $changedname = ''; 
 
    $name = ''; 
 
    $lastname = ''; 
 
    $phonenumber; 
 
    $nnumber; 
 
    $type =''; 
 
    $mail = ''; 
 
    $resume; 
 
    $type = ''; 
 
    $notify = ''; 
 
    $nameErr= ""; 
 
    $mailErr = ""; 
 
    $resumeErr = ""; 
 
    $nnumberErr = ""; 
 
    $lastnameErr = ""; 
 
    $phonenumberErr = ""; 
 
    $notsentErr = ""; 
 
    $sizeErr = ""; 
 
    if($_SERVER['REQUEST_METHOD'] == 'POST') 
 
    { 
 
    $name = mysql_real_escape_string($_POST['name']); 
 
    $lastname = mysql_real_escape_string($_POST['lastname']); 
 
    $phonenumber = mysql_real_escape_string($_POST['phonenumber']); 
 
    $nnumber = mysql_real_escape_string($_POST['nnumber']); 
 
    $mail = mysql_real_escape_string($_POST['mail']); 
 
    if(isset($_FILES['resume'])) 
 
    { 
 
     $filename = $_FILES['resume']['name']; 
 
     $filesize = $_FILES['resume']['size']; 
 
     $filetype = $_FILES['resume']['type']; 
 
     $filetmp = $_FILES['resume']['tmp_name']; 
 
     if($_FILES['resume']['error'] !== 0) 
 
     { 
 
     $alarm = true; 
 
     } 
 
     $AllowedTypesArray = array('docx' , 'rtf' , 'pdf'); 
 
     $changedname = 'Rayka_' . rand(1000,9000) . '_' . '5SV4DFS_A245DFA' . '_' . time() . '_' . $name; 
 
     $info = pathinfo($filename , PATHINFO_EXTENSION); 
 

 
     if($alarm = true) 
 
     { 
 

 
     } 
 
     if($filetype == 'application/pdf') 
 
     { 
 
     $type = '.pdf'; 
 
     } 
 
     if($filetype == 'application/msword') 
 
     { 
 
     $type = '.docx'; 
 
     } 
 
     if($filetype == 'application/rtf') 
 
     { 
 
     $type = '.rtf'; 
 
     } 
 
     if(!$type) 
 
     { 
 
     $resumeErr = "file's type is not supported"; 
 
     } 
 
     if(!in_array($info , $AllowedTypesArray)) //checks if filetype is pdf , rtl or docx and also , checks if the file is less than 2 mbs or not . 
 
     { 
 
     $error = "file's type is not supported"; 
 
     $alarm = true; 
 
     } 
 
     if($filesize > 2097152) 
 
     { 
 
     $sizeErr ="Your file must be less than 2 Mbs"; 
 
     } 
 
     $path = dirname(__FILE__).'/_ufile/'.$changedname . $type; 
 
     var_dump($path); 
 
    if(!move_uploaded_file($_FILES['resume']['tmp_name'] , $path)) 
 
     { 
 
     $alarm = true; 
 
     $notsentErr = 'File was not sent'; 
 
     } 
 
    } 
 
    if(!isset($_FILES['resume'])) 
 
    { 
 
     $resumeErr = 'attachment is not chosen'; 
 
     $alarm = true; 
 
    } 
 
      if($_SERVER['REQUEST_METHOD'] == 'POST') 
 
      { 
 
       if (empty($_POST["name"])) 
 
       { 
 
        $nameErr = "Enter your name"; 
 
       } 
 
       else 
 
       { 
 
        $name = test_input($_POST["name"]); 
 
       } 
 
      } 
 
      if(empty($_POST['lastname'])) 
 
      { 
 
       $lastnameErr = "Enter your last name"; 
 
      } 
 
      else { 
 
       $lastname = test_input($_POST['lastname']); 
 
      } 
 
      if(empty($_POST['phonenumber'])) 
 
      { 
 
       $phonenumberErr = "Enter your phone number"; 
 
      } 
 
      else 
 
      { 
 
       $phonenumber = test_input($_POST['phonenumber']); 
 
      } 
 
      if(empty($_POST['nnumber'])) 
 
      { 
 
       $nnumberErr = "Enter your second phone number"; 
 
      } 
 
      else 
 
      { 
 
       $nnumber = test_input($_POST['nnumber']); 
 
      } 
 
      if(empty($_POST['mail'])) 
 
      { 
 
       $mailErr = "enter your email address"; 
 
      } 
 
      else 
 
      { 
 
       $mail = test_input($_POST['mail']); 
 
      } 
 
      if((!$nameErr) && (!$lastnameErr) && (!$mailErr) && (!$phonenumberErr) && (!$nnumberErr) && (!$notsentErr) && (!$sizeErr)) 
 
      { 
 

 
      $query = "INSERT INTO users (`id`,`name`, `lastname`, `phonenumber`, `nnumber`, `mail`, `resume`) VALUES (NULL , \"$name\",\"$lastname\",\"$phonenumber\",\"$nnumber\",\"$mail\",\"$changedname\")"; 
 
      $notify = "Successful"; 
 
      $success = true; 
 
      $insert = query($query); 
 
      $error2 = mysql_error(); 
 
      } 
 
    } 
 
    ?>

+0

这不可能是完整的脚本中,使用?什么是$文件类型? – Naruto

+0

是的,它其实只是它的一部分。 filetype实际上是这样的:$ filetype = $ _FILES ['resume'] ['type']; –

+0

那么我会发布整个脚本。 –

回答

1

在这里,我用什么(我改变了你的需要):

$finfo = finfo_open(FILEINFO_MIME_TYPE); 
$mime = finfo_file($finfo, $_FILES['resume']['tmp_name']); 
$ok = false; 
switch ($mime) { 
    case 'application/pdf': 
    case 'application/msword': 
    case 'text/pdf': 
    case 'application/rtf': 
    case 'application/x-rtf': 
    case 'text/richtext': 
    case 'application/vnd.openxmlformats-officedocument.wordprocessingml.document': 
     $ok = true; 
     break; 
    default: 
     die(); 
} 

这里完整的MIME类型列表:https://www.sitepoint.com/web-foundations/mime-types-complete-list/

+0

这是我会遵循的方法。非常重要的警告字:MIME类型不能证明文件是它声称的。尽管我是英语,但我可以称自己是法国人。永远不要假设MIME在安全上下文中是正确的。 PDF和docx文件是邪恶有效载荷中最常见的两种格式 - 除了任何MIME检查外,我还强烈建议进行病毒扫描和/或转换为图像等。 – wally

+0

非常感谢您抽出时间MaximeK。我想用die();避免运行其他代码 –

+0

@SinaR - http://php.net/manual/en/function.die.php和http://php.net/manual/en/function.finfo-file.php – wally