<?php/* **Simple file upload script. Copyright 2008 Daniel Sowden <daniel3322@gmail.com> http://doon.freehostia.com**I found this file floating around in a heap of old php files I had written a fair while ago. I have had a quick lookat it and I am quite confident that it works. If for some reason it doesn't please contact me so that I can make ammendments to it. It should be reasonably secure, but I make no garuantees: *use at your own risk*You are free to use this code in any way you want as long as you do not remove this notice (a link back to my sitewould also be appreciated :). You may re-distribute this code only if the original code and this notice are still intact */if(isset($_POST["submit"])) { if($_FILES["fUpload"]["error"] > 0) { switch($_FILES["fUpload"]["error"]) { case 1: echo "File exceeded upload_max_filesize<br />"; break; case 2: echo "File exceeded max_file_size<br />"; break; case 3: echo "File only partially uploaded<br />"; break; case 4: echo "No File Uploaded<br />"; break; } } //mime types of the files you want to allow to br uploaded //A few examples are already entered $allowed_types = array( "text/plain", "image/bmp", "image/jpeg", "image/gif", "image/png", "image/tiff"); foreach($allowed_types as $allowed_file) { if($_FILES["fUpload"]["type"] == $allowed_file) { if(!$_FILES["fUpload"]["error"]) { $upload = do_upload(); echo !$upload ? "Error moving uploaded file" : "Upload Successful"; else $upload = false; break; } } if(!$upload) { echo "File Type Not Allowed"; } }function do_upload() { $file = $_FILES["fUpload"]["tmp_name"]; $name = $_FILES["fUpload"]["name"]; if(!is_uploaded_file($file)) die("possible file upload attack"); if(!move_uploaded_file($file,"./files/".$name)) return false; return true; }echo"<form method=\"post\" action=\"".$_SERVER["PHP_SELF"]."\" enctype=\"multipart/form-data\" method=\"post\"> <input type=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"1048576\" /> File: <input type=\"file\" name=\"fUpload\" /> <input type=\"submit\" name=\"submit\" /></form>\n";?>