I'm working on an upload file program in PHP in OOP style. I need some feedback about code.
index.php
<?php
require_once('./lib/upload.php');
?>
<?php
if(isset($_FILES['file'])){
$fileupload = new upload();
if(!$fileupload -> sizeck()){
if($fileupload -> extens()){
if($fileupload -> uploadfile()){
echo 'Fisierul a fost uploadat';
}
}
}
}
?>
<html>
<head></head>
<body>
<form align="center" enctype="multipart/form-data" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]); ?>" method="post">
Select upload file: <input type="file" name="file" required="yes" />
<input type="submit" value="Trimite" />
<p>
<p>
<p>
<br>If you want to view file and download <a href="./upload/"> click here </a>
</form>
</body>
</html>
lib/upload.php
<?php
class upload{
public $src = "upload/";
public $tmp;
public $filename;
public $typefl;
public $uploadfile;
public $type = array("php", "css", "js", "html", "htm", ".php");
function __construct(){
$this -> filename = $_FILES["file"]["name"];
$this -> tmp = $_FILES["file"]["tmp_name"];
$this -> uploadfile = $this -> src . basename($this -> filename);
}
public function sizeck(){
if($_FILES["file"]["size"] > 50000000){
echo "Fisier prea mare";
return true;
}
}
public function extens(){
$this -> typefl = pathinfo($this -> filename, PATHINFO_EXTENSION);
if(in_array($this -> typefl, $this -> type)){
echo "Fisier nepermis!!!";
return false;
}
else{
return true;
}
}
public function uploadfile(){
if(move_uploaded_file($this -> tmp, $this -> uploadfile)){
return true;
}
}
}
?>
.phpfiles? Because that seems very dangerous. You might want to include some kind of MIUME checker. There are a couple ones out there using CURL to get the actual MIME type, but uploads are always dangerous. \$\endgroup\$