Error moving uploaded file using jQuery & PHp

Question

$(document).ready(function(){

        var status;
        var photo_url;
        var ext;

    $("#photo_file").change(function() {

        photo_url = this.value.split("\\").pop();

        ext = photo_url.split('.').pop().toLowerCase();

        if ( (ext == "jpg" ) || ( ext == "jpeg") ||  (ext == "png") ) {
            $.get('ajax/post.php', {photo_url: photo_url});
        } else {


            alert("incorrect file type, allowed: jpg, jpeg, png.");
        }

    });

this is "post.php"

<?php

    $photo_url = $_GET['photo_url'];

    $file_path = 'uploaded_photos/' . $photo_url;
    $photo_url = 'img/' . $photo_url;

    move_uploaded_file($photo_url, $file_path);

?>

Everything works fine i get the filename of photo but i can't move it to another folder using move_uploaded_file(); function.

You have a fatal security hole; attackers can write any file in your server disk. — SLaks, Oct 11 '13 at 17:48
The server needs more than the file input's value. If you're not going to use a form, the only alternative is to use `window.FormData` which isn't supported in all browsers. http://stackoverflow.com/questions/166221/how-can-i-upload-files-asynchronously-with-jquery?rq=1 The suggested solution is to just use a form, it's cross-browser, easy to implement, **and doesn't *require* a page refresh**. — Kevin B, Oct 11 '13 at 17:56

score 0 · Answer 1 · answered Oct 11 '13 at 17:47

0

You need to use the temporary filename ($_FILES['userfile']['tmp_name']).

http://www.php.net/manual/en/features.file-upload.post-method.php

The move_uploaded_file function only works on files PHP knows were uploaded through it.

answered Oct 11 '13 at 17:47

yakatz

2,142
1
18
47

but how can i get the temporary filename ? i dont want to use a form etc. i only have the filename and path? – user2871510 Oct 11 '13 at 17:48
PHP gives you all the information you need about the uploaded file in the `$_FILES` global. If you are not actually uploading the file in this script (looking again, I don't see that in your JavaScript), then `move_uploaded_file` is the wrong function to use. If that is the case, I do have a serious security concern (as others have mentioned). – yakatz Oct 11 '13 at 17:51
I dont't want to use a "form" how can i upload using javscript ? – user2871510 Oct 11 '13 at 17:53
2

That’s a completely different question now – and not a good one at that. Please describe explicitly what you want to achieve. – CBroe Oct 11 '13 at 17:56
You need a form to upload a file or you would need to start with an AJAX POST instead of GET and manually load the file into the JavaScript. You would be better off with a library, but most of those just use JavaScript to create and submit a `
`.
– yakatz Oct 11 '13 at 17:57

Error moving uploaded file using jQuery & PHp

1 Answers1