Prevent PHP script from being executed when submitting to self

Question

I have this form:

<form name="commentform" id="commentform" action="comment.php" method="post" enctype="multipart/form-data"> Your Name: <textarea maxlength="60" rows="1" cols="62" class="margin" name="name" id="name"> </textarea> <br><br> Submit Picture <input type="file" name="pic" id="pic" /> <br><br> <input type="Submit" value="Submit" /> </form>

This is the PHP to validate the picture (from W3Schools.com):

<?php if ((($_FILES["file"]["type"] == "image/gif") || ($_FILES["file"]["type"] == "image/jpeg") || ($_FILES["file"]["type"] == "image/pjpeg")) && ($_FILES["file"]["size"] < 20000)) { if ($_FILES["file"]["error"] > 0) { echo "Return Code: " . $_FILES["file"]["error"] . "<br />"; } else { echo "Upload: " . $_FILES["file"]["name"] . "<br />"; echo "Type: " . $_FILES["file"]["type"] . "<br />"; echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />"; echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />"; if (file_exists("upload/" . $_FILES["file"]["name"])) { echo $_FILES["file"]["name"] . " already exists. "; } else { move_uploaded_file($_FILES["file"]["tmp_name"], "upload/" . $_FILES["file"]["name"]); echo "Stored in: " . "upload/" . $_FILES["file"]["name"]; } } } else { echo "Invalid file"; } ?>

I am the submitting the form to the same page, so the PHP is executed as soon as the webpage loads. How can I make it load as soon as the form is submitted? Also, this script does not seem to be working.

oOoK!I suggest you jahufar answer! before you process your php you need to verify that form is submitted or not! use if( isset($_POST('submit')) ), put your whole code in this if statement — Hamid
– Hamid, Commented Jul 3, 2011 at 16:33

Jay Sidri · Accepted Answer · 2011-07-03 16:28:21Z

You need to check if your form is submitted before you process the file upload:

if ( isset($_POST['pic'])) { //save file here. }

EDIT: It looks like your not referring to the right POST variable - you have a file element called 'pic' in your form but you are referring to $_POST['file'] in your PHP code which will not exist.

Also: If you are starting out with PHP, (IMHO) W3Schools.com is the worse place you can be - I've seen really bad examples of how code should NOT be written in there..

I guess that would work, but my actual script is somewhat different than the one I posted above. Instead of a submit button, I submit the form using Javascript (submit()). As soon as the form is submitted, the page resets and no error message is shown.
It doesn't matter how you submit it.. it's still hitting comment.php once it is submitted what I said still applies (you need to check if the form is submitted before you can start to process it). If you are not getting any warnings, you might want to check if display_errors is set to 1 and error_reporting is set to E_ALL in your development environment's php.ini

Hamid · Accepted Answer · 2011-07-03 16:33:50Z

<?php if( isset( $_POST( 'submit' ) ) ){ // Check form is submitted or not if ((($_FILES["file"]["type"] == "image/gif") || ($_FILES["file"]["type"] == "image/jpeg") || ($_FILES["file"]["type"] == "image/pjpeg")) && ($_FILES["file"]["size"] < 20000)) { if ($_FILES["file"]["error"] > 0) { echo "Return Code: " . $_FILES["file"]["error"] . "<br />"; } else { echo "Upload: " . $_FILES["file"]["name"] . "<br />"; echo "Type: " . $_FILES["file"]["type"] . "<br />"; echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />"; echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />"; if (file_exists("upload/" . $_FILES["file"]["name"])) { echo $_FILES["file"]["name"] . " already exists. "; } else { move_uploaded_file($_FILES["file"]["tmp_name"], "upload/" . $_FILES["file"]["name"]); echo "Stored in: " . "upload/" . $_FILES["file"]["name"]; } } } else { echo "Invalid file"; } } ?>

rackemup420 · Accepted Answer · 2011-07-03 16:33:54Z

Add This To the Top of your page:

<?php $action = $_GET['action']; ?>

Your New Form:

<form name="commentform" id="commentform" action="comment.php?action=go" method="post" enctype="multipart/form-data"> Your Name: <textarea maxlength="60" rows="1" cols="62" class="margin" name="name" id="name"> </textarea> <br><br> Submit Picture<input type="file" name="pic" id="pic" /> <br><br> <input type="Submit" value="Submit" /> </form>

And the action script:

<?php if (isset($action) && $action == 'go'){ if ((($_FILES["file"]["type"] == "image/gif") || ($_FILES["file"]["type"] == "image/jpeg") || ($_FILES["file"]["type"] == "image/pjpeg")) && ($_FILES["file"]["size"] < 20000)) { if ($_FILES["file"]["error"] > 0){ echo "Return Code: " . $_FILES["file"]["error"] . "<br />"; }else{ echo "Upload: " . $_FILES["file"]["name"] . "<br />"; echo "Type: " . $_FILES["file"]["type"] . "<br />"; echo "Size: " . ($_FILES["file"]["size"] / 1024) . " Kb<br />"; echo "Temp file: " . $_FILES["file"]["tmp_name"] . "<br />"; if (file_exists("upload/" . $_FILES["file"]["name"])) { echo $_FILES["file"]["name"] . " already exists. "; }else{ move_uploaded_file($_FILES["file"]["tmp_name"], "upload/" . $_FILES["file"]["name"]); echo "Stored in: " . "upload/" . $_FILES["file"]["name"]; } } }else{ echo "Invalid file"; } } ?>

I guess nevermind :D just read your answer above :D, guess this wouldnt help for javascript, but would have been nice to know that ahead of time :D.

Collectives™ on Stack Overflow

Prevent PHP script from being executed when submitting to self

3 Answers 3

2 Comments

Comments

1 Comment

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

Comments

1 Comment

Related