Page 1 of 1

PHP/Flash 8 File Upload/Data Validation

Posted: Tue Sep 26, 2006 5:34 pm
by Toot4fun
I have a page on my site where I allow users to upload files. In addition to the actual file, the user is required to enter data about the file (keyword(s), description, etc). The page that I have now is 100% PHP and does almost everything that I need - data validation, SQL INSERT, file upload, etc. However, my problem with the current setup is this: I have imposed a 5MB limit on the uploaded files. Unfortunately, PHP does not have access to the local file system, so it is unable to check the file size before the upload. PHP has to upload the file to the server, then determine if it's too large. If a user selects a 100MB file, this entire file has to get uploaded before PHP can tell the user that it's too large (this usually times out anyway, but you see my point).

After doing some research, it seems like I'll have to use something else (Flash in my case) to get the file size before the upload. Since I'm not a Flash programmer, this has been a little more challenging than I had anticipated. What I would like to do is keep the keyword and description fields as regular HTML <input>s and only have the file selection be in Flash. I found a few examples of this integration, but when I try to do the same with my page, the file does not get uploaded.

I guess what I would really like is for the user to select the file with a Flash movie which will let me check the size before upload (this part I have). Then, I'd like to have the movie submit the form, check that nothing is blank, a file is selected, etc. before submiting the form.

Does anyone have any experience with this scenario? I might just need some people from the outside to tell me that I'm looking at this completely wrong. One other thing - my upload has to happen AFTER my MySQL INSERT, since the files are named on the server according to the mysql_insert_id() and other selections from the form on my PHP page.

Thanks!!

Posted: Tue Sep 26, 2006 5:53 pm
by volka
Unfortunately, PHP does not have access to the local file system, so it is unable to check the file size before the upload. PHP has to upload the file to the server, then determine if it's too large.
php is executed server-side and has no access to the client's filesystem. Therefore it cannot upload anything from there. It's the client itself that is uploading the data.
I guess what I would really like is for the user to select the file with a Flash movie which will let me check the size before upload (this part I have). Then, I'd like to have the movie submit the form, check that nothing is blank, a file is selected, etc. before submiting the form.
I doubt that you're able to set or even read the filepath from an input/file element. It's quite sensitve data that browers don't lightly grant access to.
A complete flash solution is more likely to work. Did you search the web for examples, maybe frameworks? Looks like there a lot of articels and code.

Posted: Tue Sep 26, 2006 6:59 pm
by jwalsh

Code: Select all

<form enctype="multipart/form-data" action="_URL_" method="post">
 <input type="hidden" name="MAX_FILE_SIZE" value="30000" />
 Send this file: <input name="userfile" type="file" />
 <input type="submit" value="Send File" />
</form>
Easily bypassed with javascript. In the case of a malicious attempt, always still double check filesize using some other method... but this can save load on the server uploading files that don't fit your criteria in most legitimate cases.

Posted: Tue Sep 26, 2006 9:48 pm
by Toot4fun
I feel silly having to say this, but your example doesn't use any JavaScript. I'm running something similar now, but the problem is that PHP can't get the size until the file is already uploaded. JavaScript doesn't have access to the local file system, so I'm not quite sure how that helps me.

Posted: Tue Sep 26, 2006 10:17 pm
by Burrito
Moved to client side.