Error during file upload

This is probably useful to someone.

<?php

$phpFileUploadErrors

= array(
    0 => 'There is no error, the file uploaded with success',
    1 => 'The uploaded file exceeds the upload_max_filesize directive in php.ini',
    2 => 'The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form',
    3 => 'The uploaded file was only partially uploaded',
    4 => 'No file was uploaded',
    6 => 'Missing a temporary folder',
    7 => 'Failed to write file to disk.',
    8 => 'A PHP extension stopped the file upload.',
);

This is a handy exception to use when handling upload errors:

<?php
class UploadException extends Exception

{

    public function __construct($code) {

        $message = $this->codeToMessage($code);

        parent::__construct($message, $code);

    }

    private function

codeToMessage($code)

    {

        switch ($code) {

            case UPLOAD_ERR_INI_SIZE:

                $message = "The uploaded file exceeds the upload_max_filesize directive in php.ini";

                break;

            case UPLOAD_ERR_FORM_SIZE:

                $message = "The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form";

                break;

            case UPLOAD_ERR_PARTIAL:

                $message = "The uploaded file was only partially uploaded";

                break;

            case UPLOAD_ERR_NO_FILE:

                $message = "No file was uploaded";

                break;

            case UPLOAD_ERR_NO_TMP_DIR:

                $message = "Missing a temporary folder";

                break;

            case UPLOAD_ERR_CANT_WRITE:

                $message = "Failed to write file to disk";

                break;

            case UPLOAD_ERR_EXTENSION:

                $message = "File upload stopped by extension";

                break;

            default:

$message = "Unknown upload error";

                break;

        }

        return $message;

    }

}
// Use

if ($_FILES['file']['error'] === UPLOAD_ERR_OK) {

//uploading successfully done

} else {

throw new UploadException($_FILES['file']['error']);

}

?>

<?php

array(

        0=>"There is no error, the file uploaded with success",

        1=>"The uploaded file exceeds the upload_max_filesize directive in php.ini",

        2=>"The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form"

        3=>"The uploaded file was only partially uploaded",

        4=>"No file was uploaded",

        6=>"Missing a temporary folder"

);

?>

$_FILES and $_POST will return empty

PHP has the somewhat strange feature of checking multiple "maximum file sizes".

The two widely known limits are the php.ini settings "post_max_size" and "upload_max_size", which in combination impose a hard limit on the maximum amount of data that can be received.

In addition to this PHP somehow got implemented a soft limit feature. It checks the existance of a form field names "max_file_size" (upper case is also OK), which should contain an integer with the maximum number of bytes allowed. If the uploaded file is bigger than the integer in this field, PHP disallows this upload and presents an error code in the $_FILES-Array.

The PHP documentation also makes (or made - see bug #40387 - http://bugs.php.net/bug.php?id=40387) vague references to "allows browsers to check the file size before uploading". This, however, is not true and has never been. Up til today there has never been a RFC proposing the usage of such named form field, nor has there been a browser actually checking its existance or content, or preventing anything. The PHP documentation implies that a browser may alert the user that his upload is too big - this is simply wrong.

Please note that using this PHP feature is not a good idea. A form field can easily be changed by the client. If you have to check the size of a file, do it conventionally within your script, using a script-defined integer, not an arbitrary number you got from the HTTP client (which always must be mistrusted from a security standpoint).

If not the $_FILES show you an error #6 "Missing a temporary folder

<?php
class Some {
    /**
     * Upload error codes
     * @var array
     */
    private static $upload_errors = [];

    public function

__construct() {
        // Init upload errors
        self::$upload_errors = [
            UPLOAD_ERR_OK => _('There is no error, the file uploaded with success.'),
            UPLOAD_ERR_INI_SIZE => _('The uploaded file exceeds the upload_max_filesize directive in php.ini.'),
            UPLOAD_ERR_FORM_SIZE => _('The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form.'),
            UPLOAD_ERR_PARTIAL => _('The uploaded file was only partially uploaded.'),
            UPLOAD_ERR_NO_FILE => _('No file was uploaded.'),
            UPLOAD_ERR_NO_TMP_DIR => _('Missing a temporary folder.'),
            UPLOAD_ERR_CANT_WRITE => _('Cannot write to target directory. Please fix CHMOD.'),
            UPLOAD_ERR_EXTENSION => _('A PHP extension stopped the file upload.'),
        ];
    }
}
?>

So, instead of this:

-----

<?php

if($_FILES['userfile']['error']) {

  // handle the error

} else {

  // process

}

?>

-----

You have to do this:

-----

<?php

if($_FILES['userfile']['error']==0) {

  // process

} else {

  // handle the error

}

?>

-----

Also, ctype_digit fails, but is_int works.  If you're wondering... no, it doesn't make any sense.

To Schoschie:

You ask the question:  Why make stuff complicated when you can make it easy?  I ask the same question since the version of the code you / Anonymous / Thalent (per danbrown) have posted is unnecessary overhead and would result in a function call, as well as a potentially lengthy switch statement.  In a loop, that would be deadly... try this instead:

-----

<?php

$error_types = array(

1=>'The uploaded file exceeds the upload_max_filesize directive in php.ini.',

'The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form.',

'The uploaded file was only partially uploaded.',

'No file was uploaded.',

6=>'Missing a temporary folder.',

'Failed to write file to disk.',

'A PHP extension stopped the file upload.'

);
// Outside a loop...

if($_FILES['userfile']['error']==0) {

  // process

} else {

  $error_message = $error_types[$_FILES['userfile']['error']];

  // do whatever with the error message

}
// In a loop...

for($x=0,$y=count($_FILES['userfile']['error']);$x<$y;++$x) {

  if($_FILES['userfile']['error'][$x]==0) {

    // process

  } else {

    $error_message = $error_types[$_FILES['userfile']['error'][$x]];

    // Do whatever with the error message

  }

}
// When you're done... if you aren't doing all of this in a function that's about to end / complete all the processing and want to reclaim the memory

unset($error_types);

?>

<?php

if($_FILES["file_id"]["size"]  == 0)

{

         // ...PROCESS ERROR

}

?>

So UPLOAD_ERR_NO_FILE is not an error, but a note that the input element just had no value. Thus you can't rely on the $_FILES array to see if a file was provided. Instead you have to walk the array and check every single damn entry - which can be quite difficult since the values may be nested if you use input elements named like "foo[bar][bla]".

Seems like PHP just introduced you to yet another common pitfall.

Since $_FILES allows for more than a single file, this loops through each file and if there's an error, it is displayed in human readable language to the error log and then returned / exited.  You can adjust that to echo's if preferred:

function file_upload_test($messageBefore="CM FILE UPLOAD MESSAGE"){
    global $_FILES;
    # a single file limit
    $upload_max_size = ini_get('upload_max_filesize');
    # the combination of a batch o multiple files
    $post_max_size = ini_get('post_max_size');
    # array of possible fails which are retuned below in if $key=error section
    $phpFileUploadErrors = array(
        0 => 'There is no error, the file uploaded with success',
        1 => 'Exceeds php.ini upload_max_filesize of '.$upload_max_size.'MB',
        2 => 'The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form',
        3 => 'The uploaded file was only partially uploaded',
        4 => 'No file was uploaded',
        6 => 'Missing a temporary folder',
        7 => 'Failed to write file to disk.',
        8 => 'A PHP extension stopped the file upload.',
    );

    error_log("========================================");
    error_log("$messageBefore");
    error_log("========================================");
    foreach ($_FILES['cmmediabrowsedfor'] as $key => $value) {
       ${$key}=$value;
       error_log('$_FILES ['.$key.'] = ['.$value.']');
       if(is_array($value)){
            foreach ($value as $key2 => $value2) {
                error_log('   >   $_FILES ['.$key.']['.$key2.'] = '.$value2);
                if($key=='error'){
                     error_log('   ******* CM Failed Upload: '.$phpFileUploadErrors[$value2]);
                     error_log('           Exit / Return in plugins/cm-alpha/php/images/img-create-tmp.php');
                     error_log(' ');
                     exit;
                }
            }
       }
    }
    if(!file_exists($_FILES["cmmediabrowsedfor"]["tmp_name"][0]) || !is_uploaded_file($_FILES["cmmediabrowsedfor"]["tmp_name"][0])) {
        error_log("NO FILE GOT UPLOADED ");
    } else {
        error_log("SUCCESS FILE GOT UPLOADED ");
    }
}

The reason we want to check the version is that the constants are not defined in earlier versions, and they appear later in the array. They would effectively overwrite the "0" index (no error) with an error message when the file actually uploaded fine.

It also drops the constant's value (0,1,2, etc) for the errors, in the likely event that they are changed later (the code should still work fine).

<?php

$upload_errors

= array(
    0                        => "There is no error, the file uploaded with success"
    ,UPLOAD_ERR_INI_SIZE    => "The uploaded file exceeds the upload_max_filesize directive in php.ini"
    ,UPLOAD_ERR_FORM_SIZE    => "The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form"
    ,UPLOAD_ERR_PARTIAL        => "The uploaded file was only partially uploaded"
    ,UPLOAD_ERR_NO_FILE        => "No file was uploaded"
);

if (

version_compare(PHP_VERSION, '5.0.3') >= 0)
    $upload_errors[UPLOAD_ERR_NO_TMP_DIR] = "Missing a temporary folder";

if (

version_compare(PHP_VERSION, '5.1.0') >= 0)
    $upload_errors[UPLOAD_ERR_CANT_WRITE] = "Failed to write to disk";

if (

version_compare(PHP_VERSION, '5.2.0') >= 0)
    $upload_errors[UPLOAD_ERR_EXTENSION] = "File upload stopped by extension";
?>

Hopefully, this tidbit will save someone else some grief.

But i see only one side to generating Exceptions. ie For the developers.

Why ? Because when you generate an Exception, your script will come to an halt and do whatever you have defined in catch clause.
Now you dont want any client to see the Exception, do you ? I will not. The client will want to know what error occured in simple words they can understand instead of wanting their web app crashed if upload fails. So,  dont generate exceptions. These errors should be collected and shown to client in an elegant way. That's a little advice.
Keep developing smarter.

enctype="multipart/form-data" works fine

actually, both $_FILES and $_REQUEST in the posted to script are empty?

just see, if  "post_max_size" is lower than the data you want to load.

in the apache error log, there will be an entry like "Invalid method in request". and in the access log, there will be two requests: one for the POST, and another that starts with all "----" and produces a 501.

2. If in file field we paste something, like, D:whatever , then there also isn`t an error to return in spite of that no such file at all.