上传文件上传任何内容

Question

My Form is simple and I thought the uploading php was simple, but when i test it the results are unusual. I can upload any file and any size and it will Work. I thought i had written it to restrict certain files and sizes...Where am I going wrong?

Form:

 <form enctype="multipart/form-data" action="upload_file.php" method="POST">
 Please choose a file: <input name="uploaded" type="file" /><br />
 <input type="submit" value="Upload" />
 </form> 

upload_file.php:

    $target = "uploads/"; 
    $target = $target . basename( $_FILES['uploaded']['name']) ; 
    $ok = 1; 
    $uploaded = $_POST['uploaded'];
//This is our size condition 
    if ($uploaded_size > 3000){ 
        echo "Your file is too large.<br>"; 
        $ok=0; 
    } 

//This is our limit file type condition 
    if ($uploaded_type == "text/php"){ 
        echo "No PHP files are allowed for upload.<br>"; 
        $ok = 0; 
    } 

//Here we check that $ok was not set to 0 by an error 
    if ($ok == 0){ 
        Echo "Sorry your file was not uploaded"; 
    } 

//If everything is ok we try to upload it 
    else{ 
        if(move_uploaded_file($_FILES['uploaded']['tmp_name'], $target)){ 
            echo "The file ". basename( $_FILES['uploadedfile']['name']). " has been uploaded"; 
        } 
        else{ 
            echo "Sorry, there was a problem uploading your file."; 
        } 
    }

Answer 1

Your code is outright wrong. Nowhere do you define $uploaded_size, $uploaded_type, etc... so the code boils down to:

if ($uploaded_size > 3000 {

is equivalent to

if (0 > 3000) {  // undefined variables are typecast to 0

which evaluates to false, so $ok stays 1 and no error is triggered.

I STRONGLY suggest you read the PHP manpages on handling file uploads: http://php.net/manual/en/features.file-upload.php