help with upload with ID script

Micky-D · #1 (**permalink**) Sep 20th, 2006, 18:47

Hey Im looking to create a simple upload and download system...

I want a simple upload with size and file type limits and built in expirery, say 90 days. I also want to give the upload an ID number so that when a user has completed the upload they are given an ID number.. this number will be used for downloading. When a user comes to download they go to a download page and merely enter the ID number and the download commences...

So the whole process would start with an upload box... the upload would start.. upon completion the user is ttaken to an upload successfull page which also echos the ID number the file has just been given... the user could share this number with friends.. and they would go to the download item page and enter the number, click submit and the download would start.

Where do I start?

I'm a total n00b but heres how I imagine it would work...

Upload Page:

Form with browse and upload buttons...
<unknown script> which would assign the upload a randomly generated but non repetitive ID number which would probably be stored in a mysql database and points to the file and its location... also the file might also be stored in mysql form (maybe) or as a normal file in a specified directory on the host server.

Download Page:

Another form with an input box...
data submited to the input box would use another <unknown script> to call or select from the database the corrisponding ID number and file name and commence the download..

And since all this would require database I assume a config would be needed to define the database details as well as the allowed types, sizes.. length of storage before removal ie 90 days and other things... I also imaging this config would contain defined values like the ones where you tell it that header is such a file and to call it you use $header or something like that...

Any pointers or tutorials to get me started on this? Complete n00b remember.. I wanted to start with something like this cos it seemed simple (ish) and it is something I need

Thanks guys... Also.. If people dont mind.. I will be around asking lots of questions while I create this cos as I said.. Im a total n00b when it comes to building scripts from scratch.

Thanks guys!!!

ukgeoff · #2 (**permalink**) Sep 20th, 2006, 20:55

Hi Micky,

First question has to be what sort of hosting do you have? Free or paid for and what facilities do you have available.

You are going to need a database to manage the file names, location and their respective access code.

Look at using the php function crypt(); to produce your code. If you use the datetime as a seed, there should be little chance of producing a duplicate code and anyway you could always check against the database before issuing that code and if it already exists, bin it and generate another one.

I would be inclined to just keep the files in a directory and just keep a reference to them in the database.

You can specify in your php script handling the upload such things as file types, max size, etc. and reject if not allowed. It's not something you can achieve with JavaScript at the client end before upload as you don't have the file access rights.

Start reading and working on your code and come back with specific questions otherwise replies could get a bit long winded.

Micky-D · #3 (**permalink**) Sep 20th, 2006, 22:40

Hey,

thanks for the reply. I currently have paid hosting.. 25GB storage.. 1TB xfer bandwidth.. unlimited MySQL databases and php 4 0r 5 or I can install my own php to my domain if needed so I can alter the php.ini if needed to turn certain things on or off

Ok so I have been reading here for some of the basics http://www.tizag.com/phpT/

and also

http://www.tizag.com/mysqlTutorial/index.php

As I figure they cover the basics.. I have learned HTML and I have played around with PHP but do not fully understand it yet.. So I'm hoping these small project exercises will help me

So where to start? I presume I would start with the upload form first and also the config?

//EDIT

I have started my form and insert script here

FORM

Code: Select all

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Test Database Insert Form By Micky-D</title>
</head>

<body>
<!-------------------------------------------------------->
<!-------SIMPLE INSERT FORM DATA TO DATABASE SCRIPT------->
<!-----Created By Micky-D 21st September 2006 @ 00:15----->
<!-------------------------------------------------------->

<center><b><font face="verdana, arial" size="2">This Is A Simple Form I Created To Insert Data Into A Database<br />Thanks Go To <a href="http://www.blazonry.com/" title="Blazonry.com">Blazonry</a> For The Tutorial This Is Based On<br />This Is My First Ever Script Written By Hand As Opposed To Using Dreamweaver The Lazy Way LOL ;)</font></b></center>
<br />
<!-------FORM FOR DATA TO BE INSERTED------->
<form method ="post" action"post_data.php">
<center>
<b>Some Data</b> &nbsp;<input type="text" size="15" name="some_data" />
<br />
<br />
<b>More data</b>&nbsp;&nbsp; <input type="text" Size="15" name="more_data" />
</center>
<br />
<br />
<center><input type="submit" value="Insert Data" /></center>
</form>

</body>
</html>

INSERT DATA FROM FORM TO DATABASE PHP

Code: Select all

<?php
/////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////
////-------------------------------------------------------------////
////---------SIMPLE INSERT FORM DATA TO DATABASE SCRIPT----------////
////-------------------------------------------------------------////
////-------Created By Micky-D 21st September 2006 @ 00:15--------////
////------------------Designed For www.XXXXXXXX.com--------------////
/////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////

// ---This Is The Script To Open A Database Connection---
$usr = "----databaseusername";
$pwd = "databasepassword";
$db = "databasename";
$host = "hostname.to.database";

$cid = mysql_connect($host,$usr,$pwd);
if (!$cid) { echo("ERROR: " . mysql_error() . "\n"); }
// ---END OF DATABASE CONNECTION---
?>

<?php
// ---This Is The Section That Takes Form Data And Inserts It Into The Database---
if ($REQUEST_METHOD=="POST") {

$SQL = " INSERT INTO test ";
$SQL = $SQL . " (some_data, more_data) VALUES ";
$SQL = $SQL . " ('$some_data','$more_data') ";
$result = mysql_db_query($db,"$SQL",$cid);

if (!$result) {
    echo("ERROR: " . mysql_error() . "\n$SQL\n"); }

echo ("Data Has Been Inserted\n");

}

mysql_close($cid);
// ---ENDO OF INSERT DATA SECTION---
?>

The insert form data is based on a tutorial from here http://www.blazonry.com/scripting/li...nsert_data.php

Now Im going to use this tutorial here http://www.tizag.com/mysqlTutorial/mysqltables.php to create a table to store this data in a test database I created.

I have a question about this part

Code: Select all

if (!$result) {
    echo("ERROR: " . mysql_error() . "\n$SQL\n"); }

echo ("Data Has Been Inserted\n");

}

shouldnt or couldnt it be else echo ("Data Has Been Inserted\n"); ????

ukgeoff · #4 (**permalink**) Sep 21st, 2006, 12:50

Hi Micky
Just to let you know I'm not ignoring you. Will get back to you later in the day.

ukgeoff · #5 (**permalink**) Sep 21st, 2006, 16:54

It should be:

Code: Select all

if (!$result) {
   echo("ERROR: " . mysql_error() . "\n$SQL\n");
}
else {
   echo ("Data Has Been Inserted\n");
}

As a general note, seperate your styling out into a seperate file using proper css code and link this into your html pages.

Do not use deprecated or propriatory tags like <center>.

At the moment, your php script will continue to run even if the database connection fails. You need to include in your response to a failed connection an 'exit;' command. This will terminate the script.

I don't see any point to this bit:

Code: Select all

if ($REQUEST_METHOD=="POST")

You wouldn't be running this script if the form hadn't been submitted.

You are going to need some data validation routines. Not only to check that the fields contain appropriate data but also that they don't contain anything nasty where some miscreant has attempt what is known as an sql injection attack.

Your insert sql can just be:

Code: Select all

$sql = "insert into test values (...);

and your execution code can be:
$result = mysql_query($sql, $cid);

Carry on the good work.

Micky-D · #6 (**permalink**) Sep 21st, 2006, 17:09

hey.. no worries buddy.. Im just adding to this thread as I go anyway.. kind of like a reference and progress post.. hopefully others will learn from my triumphs and mistakes

Well, It has taken me 5 hours to develop this script so far.. and at the minute its a shell... just a trial for inserting and recalling data.. I plan to build on to this to create my upload and crypt() script..

Currently I have created the following files..

FORM

Code: Select all

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Test Database Insert Form By Micky-D</title>
</head>
<body>
<!-------------------------------------------------------->
<!-------SIMPLE INSERT FORM DATA TO DATABASE SCRIPT------->
<!-----Created By Micky-D 21st September 2006 @ 00:15----->
<!-------------------------------------------------------->
<hr />
<center><b><font face="verdana, arial" size="2"><h3>This Is A Simple Form I Created To Insert Data Into A Database</h3><br />Thanks Go To <a href="http://www.blazonry.com/" title="Blazonry.com">Blazonry</a> For The Tutorial This Is Based On<br />This Is My First Ever Script Written By Hand As Opposed To Using Dreamweaver The Lazy Way LOL ;)</font></b></center>
<hr />
<br />
<!-------FORM FOR DATA TO BE INSERTED------->
<form name="DATA" method ="post" action="post_data.php">
<center>
<b>Some Data</b> &nbsp;<input name="SOME_DATA" type="text" id="SOME_DATA" size="15" />
<br />
<br />
</center>
<center><input type="submit" value="Insert Data" /></center>
</form>
<hr />
<br />
<br />
<center>
<table width="250" border="0" cellpadding="5">
<tr>
<td><center><h3><b>Here Is The Data Entered<br /></b></h3><center></td>
</tr>
<tr>
<td><center>
<!------END OF FORM------>

<?php
//-------THIS SECTION GETS THE DATA YOU JUST ENTERED-------

// ---This Is The Section To Open A Database Connection---
include ("config.php");
// ---END OF DATABASE CONNECTION---


// ---This Section Calls Newly Added Data from The Table Row---
function drawtable($qr) {
    // $qr = results of a mysql_query
    $rows = mysql_num_rows($qr);
    $toreturn = "<table style=\"float: left;\" border=\"2\">\n";
    $toreturn .= "<tr>\n";
    for ($i=0; $i<mysql_num_fields($qr); $i++) { 
        $toreturn .= "\t<th>".mysql_field_name($qr,$i)."</th>\n";
        }
    $toreturn .= "</tr>\n";
    for ($i=0; $i<$rows; $i++) { 
        $row = mysql_fetch_row($qr);
        $cols = sizeof($row);
        $toreturn .= "<tr>\n";
        for ($x=0; $x < $cols; $x++) {
            if ($row[$x]==NULL){
                $row[$x]='&nbsp;';
                }
            $toreturn .= "\t<td>$row[$x]</td>\n";
            }
        $toreturn .= "</tr>\n";
        }
    $toreturn .= '</table>';
    return $toreturn;
    }
$q = stripslashes($_POST['q']);
if (empty($q)) {
    $q = 'select SOME_DATA from test;';
    }
mysql_select_db("test1");
$result = mysql_query($q);

print "<b><font color=red>Your Newly Added Data!</font></b>\n";

echo drawtable($result);
echo '<table>
</table>
</body>
</html>';
// ---END OF CALL DATA SECTION---
?>
</center></td>
</tr>
</table>
<br />
<hr />
</center>
</body>
</html>

Post Data PHP

Code: Select all

<html>
<head>
<meta http-equiv="refresh" content="3;url=testscript.php" />
<title>DATA ADDED</title>
</head>
<body>
</body>
<?php
/////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////
////-------------------------------------------------------------////
////---------SIMPLE INSERT FORM DATA TO DATABASE SCRIPT----------////
////-------------------------------------------------------------////
////-------Created By Micky-D 21st September 2006 @ 00:15--------////
////--------------Designed For www.XXXXXXXX.com------------------////
/////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////


// ---This Is The Section To Open A Database Connection---
include ("config.php");
// ---END OF DATABASE CONNECTION---


// ---This Is The Section That Takes Form Data And Inserts It Into The Database---
if ($_SERVER['REQUEST_METHOD'] == "POST") 
    {
        # escape data and set variables
        $SOME_DATA = addslashes($_POST["SOME_DATA"]);

        # setup SQL statement
$sql  = " INSERT INTO test ";
$sql .= " (SOME_DATA) VALUES ";
$sql .= " ('$SOME_DATA') ";

        #execute SQL statement
        $result = mysql_query($sql, $cid);

        # check for error
        if (mysql_error()) { print "Database ERROR: " . mysql_error(); }

print "<center><br />
<br />
<h3><font color=red>DATA ADDED
<br />
YOU WILL NOW BE TAKEN BACK TO THE SUBMIT FORM</font>
</center>";
}
// ---ENDO OF INSERT DATA SECTION---
?>

Config PHP

Code: Select all

<?php

/////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////
////-------------------------------------------------------------////
////---------SIMPLE INSERT FORM DATA TO DATABASE SCRIPT----------////
////-------------------------------------------------------------////
////-------Created By Micky-D 21st September 2006 @ 00:15--------////
////--------------Designed For www.XXXXXXXX.com------------------////
/////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////

//---This Is The Section For Configuring The Database Connection
$usr = "username";
$pwd = "password";
$db = "database";
$host = "hostname";

$cid = mysql_connect($host,$usr,$pwd);
if (!$cid) { echo("ERROR: " . mysql_error() . "\n"); }
echo "Connected to MySQL<br />";
mysql_select_db("test1") or die(mysql_error());
echo "Connected to Database<br />";
//---END OF DATABASE CONNECTION SECTION
?>

Install

Code: Select all

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
<title>Form To Database Installer</title>
</head>

<body>
<center><font face="verdana, arial" size="2"><b>Insalling The Tables In Your Database!</b></font></center>
<br />
<br />
<center>
<table width="200" border="0">
  <tr>
    <td><center>
<?php

/////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////
////-------------------------------------------------------------////
////---------SIMPLE INSERT FORM DATA TO DATABASE SCRIPT----------////
////-------------------------------------------------------------////
////-------Created By Micky-D 21st September 2006 @ 00:15--------////
////--------------Designed For www.XXXXXXXX.com------------------////
/////////////////////////////////////////////////////////////////////
/////////////////////////////////////////////////////////////////////


// ---This Is The Script To Open A Database Connection---
mysql_connect("HOSTNAME", "USERNAME", "PASSWORD") or die(mysql_error());
mysql_select_db("test1") or die(mysql_error());
// ---END OF DATABASE CONNECTION---

// ---This Section Creates The Table In The Database Which Will Store The Submitted Data ---
mysql_query("CREATE TABLE test(
id INT NOT NULL AUTO_INCREMENT, 
PRIMARY KEY(id),
 some_data VARCHAR(30),
 other_data INT)")
 or die(mysql_error());  

echo "Install Complete";
//--- END OF DATABASE CREATION---
?></center></td>
  </tr>
</table>
</
</body>
</html>

I have tested these and they seem to work.. but I need to vary a few things...

I created this with the help of 2 or 3 tutorials I found.. most of the script is hand written.. some parts have been copied and modified to my needs as best as I can but I am really impressed that I created this and as simple as it is.. it works... WOOOOOOOOT

Ok so theres a few things I need to alter... well lots actually if I want this form to perform the things I need

I do have a few questions for now however...

How do I crypt the data in the input text area and then decrypt it when I need to call it back?

How can I alter the section of the form that displays the inserted data to only show the last entry as opposed to all the entrys and table name?

Micky-D · #7 (**permalink**) Sep 27th, 2006, 12:53

Damn.. in all this time I never noticed you answered me before I replied lol...
Cheers buddy.. Im gonna go look at your advice and apply it to my script tonight once I have gotten my daughter off to sleep

WOOT I can continue

Many thanks buddy.. I dare say we will speak soon lol!

Thanks again

8)

Micky-D · #8 (**permalink**) Sep 27th, 2006, 17:40

EXIT Positioning..

Code: Select all

$cid = mysql_connect($host,$usr,$pwd);
if (!$cid) { echo("ERROR: " . mysql_error() . "\n"); }
echo "Connected to MySQL<br />";
mysql_select_db("test1") or die(mysql_error()) exit("EXIT");
echo "Connected to Database<br />";

Is this the correct syntax and placement for my exit command??
I added it to my coinfig.php mysql connect code.

ukgeoff · #9 (**permalink**) Sep 27th, 2006, 19:48

Quote:

Originally Posted by Micky-D

EXIT Positioning..

Code: Select all

$cid = mysql_connect($host,$usr,$pwd);
if (!$cid) { 
   echo("ERROR: " . mysql_error() . "\n");
   exit();
}
else {
   echo "Connected to MySQL<br />";
}
mysql_select_db("test1") or die(mysql_error()); // Removed  exit("EXIT")
echo "Connected to Database<br />";

See changes/additions in bold. I've also spaced it out a so as to make it more readable. Suggest you get in the habit of writing your code this way. It makes it much easier to see what is haapening where.

The removed code is because die is an equivalent of exit.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Upload script + classifeds	marie2007	Starting Out	3	Jul 28th, 2007 17:35
Upload script	Perad	PHP Forum	4	Nov 27th, 2006 23:40
Upload Script	scopeweb	PHP Forum	3	Nov 27th, 2005 05:55
A not workin php upload script, need help??	ice-o	PHP Forum	3	Feb 27th, 2005 09:31
ASP upload script	GillBates	Classic ASP	0	Nov 24th, 2003 13:54

		Webforumz.com > Main Forums > Program Your Website > PHP Forum
help with upload with ID script