Necesito ayuda con esta instrucción IF, he estado mirando demasiado largo

Question

He estado escribiendo un cargador de archivos, y quiero validar los tipos y tamaño, y actualmente tengo esto:

    <?php 

//SETTING UP LOCAL VARIABLES
$username = trim($_POST['username']);
$password = trim($_POST['password']);
$name = trim($_POST['name']);
$email = trim($_POST['email']);
$message = trim($_POST['message']);

//STRIPPED OUT ALL NON ASCII CHARACTERS
$username = preg_replace('/[^(\x20-\x7F)]*/','', $username);
$password = preg_replace('/[^(\x20-\x7F)]*/','', $password);
$name = preg_replace('/[^(\x20-\x7F)]*/','', $name);
//$email = preg_replace('/[^(\x20-\x7F)]*/','', $email);

//SETTING UPLOAD DIR
$upload_dir = $_SERVER['DOCUMENT_ROOT'] . "/beta_images/";

//CREATING A RANDOM HASH TO PROTECT FROM DUPLICATE FILES
$random = rand(1, 100);

$user_hash = $random . $name;

$hash = sha1($user_hash);
$hash = substr($hash, 32, $random);

foreach ($_FILES['file']['error'] as $key => $error) {

$counter++;

if (
(
    ($_FILES['file']['type'][$key] == "image/jpeg")
 || ($_FILES['file']['type'][$key] == "image/pjpeg")
 || ($file['file']['type'][$key] == "image/jpg")
)

&& ($error == UPLOAD_ERR_OK)
&& ($_FILES['file']['size'][$key] < 20971520)
) {

        $temp_name = $_FILES['file']['tmp_name'][$key];
        $image_name = $hash . '_' . $name . $counter . '.jpg';
        move_uploaded_file($temp_name, $upload_dir . $image_name);

    } else {

    $body_fail = "Someone forgot to do something and wound up on the Sorry page. You might want to contact them and try and convince them to join still. Here are the details \n\n Username: $username \n Password: $password \n Email: $email \n Name: $name \n Message: $message";

    mail("bla", "Failed beta sign up", $body_fail);

    header("Location: ../sorry.html");

    }

}

        //EMAIL INTERNAL

            $body_internal = "Success! $name has submitted a beta entry!\n\n Their username is \n $username \n Their password is \n $password \n Their email address is $email.\n\n The images are located in \n /beta_images/{$hash}_{$name}1/2/3.jpg \n\n They also wrote a little message for us: \n$message";

            mail("bla", "New Beta Sign Up", $body_internal);

        //EMAIL INTERNAL

        //EMAIL EXTERNAL

            $body_external = "Thank you for applying to join the Stylistic Gallery, we just wanted to let you know that we have received everything and will be in touch shortly.\n\n Best Wishes \n Stylistic Gallery \n\n The Stylistic Gallery, a portal for creative individuals and businesses to showcase and sell their work online";

            mail($email, "Thank you for your application", $body_external);

        //EMAIL EXTERNAL

        header("Location: ../thanks.html");

Sin embargo, se sigue atravesando incluso si los archivos no son jpg o el tamaño es más grande.

Lo siento por ser vaga, por lo confuso de mirarlo demasiado tiempo en la actualidad)

Gracias!

Answer 1

Te estás perdiendo algunas parantheses y que desea reemplazar uno || por &&.

if (
(
    ($_FILES['file']['type'] == "image/jpeg")
 || ($_FILES['file']['type'] == "image/pjpeg")
 || ($_FILES['file']['type'] == "image/jpg")
)

&& ($error == UPLOAD_ERR_OK)
&& ($_FILES['file']['size'] < 20971520)
) {

Si usted tiene mucho tiempo si las declaraciones como esta es mejor que la descomponen. Así es como me gustaría codificar su bucle:

/* ideally you would move those messages to some text files, to make it
 * easy to change any content and eventually localize it.
 */

// mail if upload fails
$failure_mail_body_to_admin = "Someone ...";

// mail to admin after successful upload
$sucess_mail_body_to_admin = "Success! ...";

// mail to user after successful upload
$sucess_mail_body_to_user = "Thank you ...";

// mime types of allowed images, I know that those can be spoofed
$allowed_mime_types = array("image/jpeg", "image/pjpeg", "image/jpg");
$fileCount = 0;

foreach ($_FILES as $filename => $file) {
    $file_is_ok = true;
    // test general errors
    if ($file['error'] != UPLOAD_ERR_OK) {
         $file_is_ok = false;
    }

    // test size (< 20MB)
    if ($file['size'] >= 20971520) {
        $file_is_ok = false;
    }

    if (!in_array($file['type'], $allowed_mime_types) {
        $file_is_ok = false;
    }

    if ($file_is_ok) {
        $fileCount++;

        // store image
        $temp_name = $file['tmp_name'];
        $image_name = $hash . '_' . $name . $counter . '.jpg';
        move_uploaded_file($temp_name, $upload_dir . $image_name);
    }
}

if ($fileCount > 0) {
    // send confirmation mails
    mail("bla", "New Beta Sign Up", $sucess_mail_body_to_user);
    mail($email, "Thank you for your application", $sucess_mail_body_to_admin);

    // redirect user
    header("Location: ../thanks.html");
    die();
} else {
    mail("bla", "Failed beta sign up", $failure_mail_body_to_admin);

    // redirect user
    header("Location: ../sorry.html");
    die;
}

Answer 2

El hecho de que se emite un encabezado Location: no media el guión deja de ejecutar. Trate de colocar una exit; o die; justo después de la cabecera de redirección.

Además, debe morir en general a una pequeña cantidad de contenido que describe dónde ir para los navegadores que no sigue las redirecciones, por ejemplo.

die(<<< ERRORTEXT
<!doctype html>
<html><head><title>Error: Foo</title></head><body>
<h1>We're sorry, your call could not be completed as dialed.</h1>
<p><a href="../sorry.html">Click here to continue to your final destination.</a></p>
</body></html>
ERRORTEXT
);

EDIT: nitpicking

($_FILES['file']['size'][$key] < 20971520)

Lo que tenemos aquí se llama un "número mágico"; seguro de que es obvio ahora, pero no va a tomar mucho más tiempo de programación a gota o ejecución en cuanto a hacer uno de los siguientes:

($_FILES['file']['size'][$key] < 20 * 1024 * 1024)

o

define('MAX_FILE_SIZE', 20 * 1024 * 1024); // 20 MB
($_FILES['file']['size'][$key] < MAX_FILE_SIZE)