PHP: File Uploader

<?php
# @function upload_file
# 
# @param $field  string  the name of the file upload form field
# @param $dirPath string  the relative path to which to store the file (no trailing slash)
# @param $maxSize int   the maximum size of the file (in bytes)
# @param $allowed array  an array containing all the "allowed" file mime-types
#
# @return mixed  the files' stored path on success, false on failure.
function upload_file($field = '', $dirPath = '', $maxSize = 100000, $allowed = array())
{
 foreach ($_FILES[$field] as $key => $val)
  $$key = $val; 

 if ((!is_uploaded_file($tmp_name)) || ($error != 0) || ($size == 0) || ($size > $maxSize))
  return false; // file failed basic validation checks

 if ((is_array($allowed)) && (!empty($allowed)))
  if (!in_array($type, $allowed))  
   return false; // file is not an allowed type

 do $path = $dirPath . DIRECTORY_SEPARATOR . rand(1, 9999) . strtolower(basename($name));
 while (file_exists($path));

 if (move_uploaded_file($tmp_name, $path))
  return $path;

 return false;
}

// DEMO
/*
if (array_key_exists('submit', $_POST))
{
 if ($filepath = upload_file('music_upload', 'music_files', 700000, array('audio/mpeg','audio/wav')))
  echo 'File uploaded to ' . $filepath;
 else
  echo "An error occurred uploading the file... please try again.";
}
echo '   <form method="post" action="' .$_SERVER['PHP_SELF']. '" enctype="multipart/form-data">
   <input type="file" name="music_upload" id="music_upload" />
   <input type="submit" name="submit" value="submit" />
  </form>
 '; 
print_r($_FILES);  // for debug purposes
*/ 

?>

Refer to the commented section of code under the function labeled DEMO for usage. 

is_uploaded_file in PHP

is_uploaded_file — Tells whether the file was uploaded via HTTP POST
Syntax:

bool is_uploaded_file ( string $filename )
Returns TRUE if the file named by filename was uploaded via HTTP POST. This is useful to help ensure that a malicious user hasn't tried to trick the script into working on files upon which it should not be working--for instance, /etc/passwd.

This sort of check is especially important if there is any chance that anything done with uploaded files could reveal their contents to the user, or even to other users on the same system.

For proper working, the function is_uploaded_file() needs an argument like $_FILES['userfile']['tmp_name'], - the name of the uploaded file on the client's machine $_FILES['userfile']['name'] does not work.

Parameters:

filename
The filename being checked.

Return values: Returns TRUE on success or FALSE on failure.



Example #1 is_uploaded_file() example

<?php

if (is_uploaded_file($_FILES['userfile']['tmp_name'])) {
   echo "File ". $_FILES['userfile']['name'] ." uploaded successfully.\n";
   echo "Displaying contents\n";
   readfile($_FILES['userfile']['tmp_name']);
} else {
   echo "Possible file upload attack: ";
   echo "filename '". $_FILES['userfile']['tmp_name'] . "'.";
}

?>