uploading an image file

[mfaisalwarraich]

hi every body,

i am using the following code to upload an image. it directly jumps to the error message please tell me what im doing wrong here.

 
<form name="myform" enctype="multipart/form-data" method="post" action="">
Upload Album/Artist Image : <input type="file" name="imguploader"> <br />
<input type="submit" value="uploadnow" name="yes" />
</form>
 
<?php
extract($_POST);
 
if($yes){
        $img_types2 = array("image/gif","image/pjpeg","image/jpeg","image/jpg","image/bmp","image/png");
 
        if($_FILES["imguploader"]["name"]!="" && in_array($_FILES["imguploader"]["type"],$img_types2)){
        $img2 = time()."_".str_replace(" ","_",$_FILES["imguploader"]["name"]);
        move_uploaded_file($_FILES["imguploader"]["tmp_name"],"images/".$img2);
    } else {
        echo "Image file not uploaded successfully.";
    }
 
}
?>
 

this is displaying "Image file nto uploaded successfully". please tell me whats wrong with it.

[Dormilich]

instead of $yes I'd go for isset($_POST['yes'])

[mfaisalwarraich]

thanx dormilich its working now :). but what was the reason for not working with extract($_POST)? cuz this is a very simple example. if im working on a more complex site where i have variables using extract($_POST) then i will not be able to upload the image file using this method? please tell me so i can know the concept of this. thank u again

[Dormilich]

I don't know, but I consider that approach highly insecure (you may have unwanted (i.e. user injected) (global) variables going round which may serve to hack your script).

@mfaisalwarraich
you have to know the variable's name in any case, so I see no problem. further, you can do this with isset:

if (isset($var1, $var2, $var3)) { … }
// returns true only if all variables exist

[mfaisalwarraich]

ok thank u once again. this is very useful help.

[Markus]

There's an extra ending brace in there, too. Line 20.

[mfaisalwarraich]

yes thank you its eliminated markus :)