Multiple Picture Upload Problems

Question

I have a simple script that can upload files on my server and insert the details into database.

With code below I am getting two errors..

1. I tried to allow only .jpg. gif and .png formats but does not work.. All kind of formats are uploaded on server..

2. Script import numbers (1,2,3...) into Mysql if the upload filed is empty..

I tried for hours to fix these issues but I dont know whats wrong..

Thank you..

 <?php

      include_once('connect.php');

        if(isset($_FILES['files'])){
            $errors = array();
            foreach($_FILES['files']['tmp_name'] as $key => $tmp_name ){
                $file_name = $key.$_FILES['files']['name'][$key];
                $file_size = $_FILES['files']['size'][$key];
                $file_type = $_FILES['files']['type'][$key];

                if($file_type == "image/gif"){
                    $sExt = ".gif";
                } elseif($file_type == "image/jpeg" || $file_type == "image/pjpeg"){
                    $sExt = ".jpg";
                } elseif($file_type == "image/png" || $file_type == "image/x-png"){
                    $sExt = ".png";
                }
                if (!in_array($sExt, array('.gif','.jpg','.png'))) {
                    $errors[] = "Image types alowed are (.gif, .jpg, .png) only!";
                }
                $file_tmp = $_FILES['files']['tmp_name'][$key];
                $file_type = $_FILES['files']['type'][$key];
                if($file_size > 2097152){
                    $errors[]='File size must be less than 2 MB';
                }       
                $query = "INSERT into offers_pics (`offer_id`,`pic_name`,`pic_type`) VALUES ('$user_id','$file_name','$file_type'); ";
                $result = mysqli_query($link,$query);

                $desired_dir = "user_data";
                if(empty($errors) == true){
                    if(is_dir($desired_dir) == false){
                        mkdir("$desired_dir", 0700);        // Create directory if it does not exist
                    }
                    if(is_dir("$desired_dir/".$file_name) == false){
                        move_uploaded_file($file_tmp,"$desired_dir/".$file_name);
                    }else{                                  // rename the file if another one exist
                        $new_dir = "$desired_dir/".$file_name.time();
                         rename($file_tmp,$new_dir) ;               
                    }
                }else{
                        print_r($errors);
                }
            }
            if(empty($error)){
                echo "Success";
            }
        }
        ?>


    <form action="" method="POST" enctype="multipart/form-data">
        <input type="file" name="files[]"> <br/>
        <input type="file" name="files[]"> <br/>
        <input type="file" name="files[]"> <br/>
        <input type="file" name="files[]"> <br/>
        <input type="file" name="files[]" > <br/><br/>
        <input type="submit"/>
    </form>

    enter code here

Answer 1

Fo the first error, the errors array is outside the foreah so you doesn't clear the error for each file, and the query to insert is outside the if that checks errors so is always ecexcuted

For the second error the same, the query is executed always you have to check if the file is uploaded.

<?php

    include_once('connect.php');

    if(isset($_FILES['files'])){
        $filesErrors = 0;
        foreach($_FILES['files']['tmp_name'] as $key => $tmp_name ){
            // MOved errors inside the foreach to clear it each loop
            $errors = array();

            // Check file is uploaded
            if ($_FILES['files']['error'][$key] == UPLOAD_ERR_NO_FILE){
                // Continue with the next file
                continue; 
            }

            $file_name = $key.$_FILES['files']['name'][$key];
            $file_size = $_FILES['files']['size'][$key];
            $file_type = $_FILES['files']['type'][$key];

            if($file_type == "image/gif"){
                $sExt = ".gif";
            } elseif($file_type == "image/jpeg" || $file_type == "image/pjpeg"){
                $sExt = ".jpg";
            } elseif($file_type == "image/png" || $file_type == "image/x-png"){
                $sExt = ".png";
            }
            if (!in_array($sExt, array('.gif','.jpg','.png'))) {
                $errors[] = "Image types alowed are (.gif, .jpg, .png) only!";
            }

            $file_tmp = $_FILES['files']['tmp_name'][$key];
            $file_type = $_FILES['files']['type'][$key];
            if($file_size > 2097152){
                $errors[]='File size must be less than 2 MB';
            }    


            if(empty($errors) == true){
                $desired_dir = "user_data";
                // Execute query inside the errors check
                $query = "INSERT into offers_pics (`offer_id`,`pic_name`,`pic_type`) VALUES ('$user_id','$file_name','$file_type'); ";
                $result = mysqli_query($link,$query);

                if(is_dir($desired_dir) == false){
                    mkdir("$desired_dir", 0700);        // Create directory if it does not exist
                }
                if(is_dir("$desired_dir/".$file_name) == false){
                    move_uploaded_file($file_tmp,"$desired_dir/".$file_name);
                }else{                                  // rename the file if another one exist
                    $new_dir = "$desired_dir/".$file_name.time();
                     rename($file_tmp,$new_dir) ;               
                }
            }else{
                $filesErrors++;
                print_r($errors);
            }
        }

        if ($filesErrors == 0){
            echo 'Success';
        }
    }
?>


<form action="" method="POST" enctype="multipart/form-data">
    <input type="file" name="files[]"> <br/>
    <input type="file" name="files[]"> <br/>
    <input type="file" name="files[]"> <br/>
    <input type="file" name="files[]"> <br/>
    <input type="file" name="files[]" > <br/><br/>
    <input type="submit"/>
</form>