Upload files using list box in PHP

Question

Hi all,

I want to upload files from a list box in php.

I am able to do it by using <input type="file"> which I found on http://www.tizag.com/phpT/fileupload.php

But when I change this <input type="file"> by <select>

i am trying this way

<form enctype="multipart/form-data" action="upload.php" method="POST">
<input type="hidden" name="MAX_FILE_SIZE" value="100000" />
Choose a file to upload: <input name="uploadedfile" type="file" />
<select name="uploadedfile" id = "fileName" size="3" style="width: 100%">
<option id = "uploadedfile" value="c:\text.txt">c:\text.txt</option>
</select>
<input type="submit" value="Upload File" />
</form>

and PHP code remains the same for both cases

<?php
$target_path = "uploads/";
$target_path = $target_path . basename( $_FILES['uploadedfile']['value']); 


if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path)) {
    echo "The file ".  basename( $_FILES['uploadedfile']['value']). 
    " has been uploaded";
} else{
    echo "There was an error uploading the file, please try again!";
}

?>

it does not work........

Regards Hemant

Answer 1

You can only use an <input type="file" /> to upload files for security reasons. These input types display a file select box and allow a user to select a file in a secure way. Allowing a server to select arbitrary files to upload like you are trying to do would be a gross breach of security.

For instance, say I implemented your <select> based option (and it worked). I could select your Windows password file to upload. I could select all sorts of nasty files that are in predefined locations.

As a total aside, your HTML has two elements with the same name. Which one is actually sent to the server will be somewhat dependant on your browser and server. You really only want one form element with the same name.

Answer 2

I'm not sure how this is supposed to work, since you are using a drop down box to ask a user to upload a file.

Drop down menus (select > option) are not, in my experience, used as inputs other than for specific choices, like "blue" vs "red".

however, you are going to run into issues with your setup because a) you the first file option outside of the select element and b) you gave both of them the same name, which means that when php gets the POST variable, it's going to create an array with two items with the same key (if it is even getting to that point).

Update

After reading Matthew's answer, I now notice the c:/text.txt you have set as the value. As he said, that's a big time no. You could in theory have it copy the entire hard drive (very slowly of course) or have some AJAX that doesn't even ask the user if they are okay with the upload and get anything on the computer.

I thought somehow you were offering the user the option to "upload" some generic file already on the server because they had nothing they could use on their end.

Answer 3

Is there any way other way i can achieve this. I am using List box and not the dropdown

Can you please sujjest which is proper way.