PHP question Forum Attachment Feature Help

Question

HI

I have a forum and I'm trying to think of how to do an "attachment" feature. You know if you make a thread you can chose to upload a file and attach it in the thread.

Should I make a table called attachment with id of the file id in table files?? Whats the best way. And I want you to be able to upload more than 1 attachment. and if it's a picture show a little miniature of the picture.

How should I check if the file exist etc? How would you do this?

Sorry for my poor english

Answer 1

I honestly would create a Column on the table of posts that says 'Attachments', and then do a comma delimited string of attachment file names

file1.png,file2.png,file3.png

then when you get it into PHP, simply explode it

$attachments = explode(',', $string);

and check for each file that you have already put in your upload directory:

foreach($attachments as $file)
{
    if(!is_file($upload_directory.$file))
    {
        $error[] = $file . " is not a valid attachment";
        // run cleanup script
    }
}

To get the attachments, it is really simple code, but you need to validate and sanitize the incoming file.

foreach($_FILES as $array)
{
    // Sanitize Here
    die("SANITIZE HERE!");

    move_uploaded_file($array['tmp_name'], $upload_dir);
}

Answer 2

You question is too broad but I'll give you some pointers:

• store the images on the disk, something like /uploads/--thread_id--/1.jpg, /uploads/--thread_id--/2.jpg and so on (this way you don't have to make any changes to your DB)

Regarding the upload process, validation and image resizing you can read more at (I recommend you read them in this order):

http://pt.php.net/manual/en/function.exif-imagetype.php -> image validation
http://php.net/manual/en/function.move-uploaded-file.php -> upload process
http://pt.php.net/manual/en/book.image.php -> image resizing & manipulation

Answer 3

Chacha's plan sounds good to me, but you have to be careful. Make sure the files that you save don't have any execution permissions and that the file isn't on a web-accessible directory on your server. I think you should put the upload directory in a directory higher than your web directory for security purposes.

Another possible way to save the files: save their binary code in blobs in the database. I'm not sure if there are any advantages to this method, but I haven't personally had to deal with file uploads.

Above all else, be careful with uploaded data!