上传图像，验证无效

Question

i have written a script to upload images,there are 2 input file upload to upload.. i have done validation in php to check which input is choosed or not so that table is not updated with blank if no image is choose.

Problem is that it update table if i choose both image..but not when 1 is choosed.

Code:

if ($_FILES["path"]["size"] > 0 && $_FILES["path1"]["size"] < 0) {
    $allowedExts = array("jpg", "jpeg", "png");
    $extension = end(explode(".", $_FILES["path"]["name"]));
//echo $extension;
    if (($extension == "jpeg")
        || ($extension == "jpg")
        || ($extension == "png")
    ) {
        if ($_FILES["path"]["error"] > 0) {
            $msg = $_FILES["path"]["error"] . "<br />";
        } else {
            move_uploaded_file($_FILES["path"]["tmp_name"],
                "../images/" . $_FILES["path"]["name"]);
        }

        $filename = "images/" . $_FILES["path"]["name"];

///update query
    }
} else if ($_FILES["path"]["size"] < 0 && $_FILES["path1"]["size"] > 0) {
    $allowedExts = array("jpg", "jpeg", "png");
    $extension = end(explode(".", $_FILES["path1"]["name"]));
//echo $extension;
    if (($extension == "jpeg")
        || ($extension == "jpg")
        || ($extension == "png")
    ) {
        if ($_FILES["path1"]["error"] > 0) {
            $msg = $_FILES["path1"]["error"] . "<br />";
        } else {
            move_uploaded_file($_FILES["path1"]["tmp_name"],
                "../images/" . $_FILES["path1"]["name"]);
        }

        $filename1 = "images/" . $_FILES["path1"]["name"];

///update query
    }
} else if ($_FILES["path"]["size"] < 0 && $_FILES["path1"]["size"] < 0) {
} else if ($_FILES["path"]["size"] > 0 && $_FILES["path1"]["size"] > 0) {
    $allowedExts = array("jpg", "jpeg", "png");
    $extension = end(explode(".", $_FILES["path"]["name"]));
//echo $extension;
    if (($extension == "jpeg")
        || ($extension == "jpg")
        || ($extension == "png")
    ) {
        if ($_FILES["path"]["error"] > 0) {
            $msg = $_FILES["path"]["error"] . "<br />";
        } else {
            move_uploaded_file($_FILES["path"]["tmp_name"],
                "../images/" . $_FILES["path"]["name"]);
        }

        $filename = "images/" . $_FILES["path"]["name"];

        $allowedExtss = array("jpg", "jpeg", "png");
        $extensions = end(explode(".", $_FILES["path1"]["name"]));
//echo $extension;
        if (($extensions == "jpeg")
            || ($extensions == "jpg")
            || ($extensions == "png")
        ) {
            if ($_FILES["path1"]["error"] > 0) {
                $msgs = $_FILES["path1"]["error"] . "<br />";
            } else {
                move_uploaded_file($_FILES["path1"]["tmp_name"],
                    "../images/" . $_FILES["path1"]["name"]);
            }

            $filename1 = "images/" . $_FILES["path1"]["name"];
///update query

        }
        header("Location: index.php?p=setings");
        exit;

I have checked each and every thing but no error found.

Answer 1

all the conditions with $_FILES["path1"]["size"] < 0 is wrong. because it can be 0 or null or false but not lesser than 0

You need to change all of your conditions.

if ($_FILES["path"]["tmp_name"] != '' && $_FILES["path1"]["tmp_name"] == '') {

} else if ($_FILES["path"]["tmp_name"] == '' && $_FILES["path1"]["tmp_name"] != '') {

} else if ($_FILES["path"]["tmp_name"] == '' && $_FILES["path1"]["tmp_name"] == '') {

} else if ($_FILES["path"]["tmp_name"] != '' && $_FILES["path1"]["tmp_name"] != '') {

}

Also this program has a lot of redundant code.. consider the code below

if ($_FILES["path"]["tmp_name"] != '' || $_FILES["path1"]["tmp_name"] != '') {

    $allowedExts = array("jpg", "jpeg", "png");
    if ( $_FILES["path"]["tmp_name"] != '' ) {
        $extension = end(explode(".", $_FILES["path"]["name"]));

        if (($extension == "jpeg")
            || ($extension == "jpg")
            || ($extension == "png")
        ) {
            if ($_FILES["path"]["error"] > 0) {
                $msg = $_FILES["path"]["error"] . "<br />";
            } else {
                move_uploaded_file($_FILES["path"]["tmp_name"],
                    "../images/" . $_FILES["path"]["name"]);
            }

            $filename = "images/" . $_FILES["path"]["name"];
        }
    }

    if ( $_FILES["path1"]["tmp_name"] != '' ) { 
        $extensions = end(explode(".", $_FILES["path1"]["name"]));

        if (($extensions == "jpeg")
            || ($extensions == "jpg")
            || ($extensions == "png")
        ) {
            if ($_FILES["path1"]["error"] > 0) {
                $msgs = $_FILES["path1"]["error"] . "<br />";
            } else {
                move_uploaded_file($_FILES["path1"]["tmp_name"],
                    "../images/" . $_FILES["path1"]["name"]);
            }

            $filename1 = "images/" . $_FILES["path1"]["name"];
        }
    }

    header("Location: index.php?p=setings");
    exit;
} else {
    // no file
}