ScTech wrote:Found the issue in upload.php
You can go ahead and remove those lines I told you to put in if it works.
if (in_array($file_ext, $allowed_ext) ===false){
$errors[] = 'File extension not allowed';
Right here you are not ending the bracket until later on so you are only defining $expiry if they uploaded a file with the wrong extension.
Below is the way I have my upload.php file now and it seems to be working.
File Name: upload.php
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Upload a File</title>
<style type="text/css">
table {
border-collapse:collapse;
}
table, td, th {
border:1px solid #999;
height:43px;
}
</style>
</head>
<body>
<?php
include('assets/inc/init.inc.php');
if (isset($_POST['expiry'], $_FILES['file'])){
$errors = array();
$allowed_ext = array("mp3","doc","txt","jpg","jpeg","gif","png");
$file_name = mysql_real_escape_string($_FILES['file']['name']);
$file_ext = strtolower(end(explode('.',$file_name)));
$file_tmp = $_FILES['file']['tmp_name'];
if (in_array($file_ext, $allowed_ext) ===false){
$errors[] = 'File extension not allowed';
}
if(empty($_POST['expiry'])) {
$expiry = time() + (10 * 60);
} else {
if(!ctype_digit($_POST['expiry'])) {
$errors[] = 'Value is not an integer.';
} else {
$expiry = time() + ($_POST['expiry'] * 60);
}
}
if (empty($errors)) {
mysql_query("INSERT INTO files (file_name, file_expiry) VALUES ('{$file_name}',{$expiry})");
move_uploaded_file($_FILES['file']['tmp_name'], "assets/files/{$_FILES['file']['name']}");
echo "<p>". htmlentities($_FILES['file']['name']) ." has been successfully uploaded.<p>";
} else {
foreach ($errors as $error){
echo $error,'<br /><br />';
}
}
}
?>
<div>
<form action="" method="post" enctype="multipart/form-data">
<table>
<tr>
<td><b>Set Expiry Time:</b> <input type="text" name="expiry" size="6" /> <b>Minutes Only<b></td>
</tr>
<tr>
<td><b>Choose a file:</b> <input type="file" name="file" /></td>
</tr>
<tr>
<td><input type="submit" value="Upload!" /></td>
</tr>
<tr>
<td><p><a href="file_list.php">Click here</a> to download your time sensitive file, or files.</p></td>
</tr>
</table>
</form>
</div>
</body>
</html>
I moved the bracket up for the following code and it seems to be working perfect now.
if (in_array($file_ext, $allowed_ext) ===false){
$errors[] = 'File extension not allowed';
