I am trying to allow users to upload profile pics on my site. Basically I am following this code: Allow users to upload a pic for their profile.
I don't know if the code is secure enough. I am worried that users may upload malicious files.
Also, I am concerned that if there is many users, I will have many pictures in a single folder and it may slow down the retrieving process. I wonder what is the best practice in storing the profile pics. How many photos maximum should there be in a folder for better efficiency?
if(is_uploaded_file($_FILES['image']['tmp_name']))
{
uploadImage($_FILES['image']['tmp_name'], 100, 100, "image/users/test2.jpeg");
}
and
function uploadImage($source, $max_width, $max_height, $destination) {
list($width, $height) = getimagesize($source);
if ($width > 150 || $height > 150) {
$ratioh = $max_height / $height;
$ratiow = $max_width / $width;
$ratio = max($ratioh, $ratiow);
// New dimensions
$newwidth = intval($ratio * $width);
$newheight = intval($ratio * $height);
$newImage = imagecreatetruecolor($newwidth, $newheight);
$ext = trim(strtolower($_FILES['image']['type']));
$sourceImage = null;
// Generate source image depending on file type
switch ($ext) {
case "image/jpg":
case "image/jpeg":
$sourceImage = imagecreatefromjpeg($source);
break;
case "image/gif":
$sourceImage = imagecreatefromgif($source);
break;
case "image/png":
$sourceImage = imagecreatefrompng($source);
break;
}
imagecopyresampled($newImage, $sourceImage, 0, 0, 0, 0, $newwidth, $newheight, $width, $height);
// Output file depending on type
switch ($ext) {
case "image/jpg":
case "image/jpeg":
imagejpeg($newImage, $destination);
break;
case "image/gif":
imagegif($newImage, $destination);
break;
case "image/png":
imagepng($newImage, $destination);
break;
}
// Destroy resources
imagedestroy($newImage);
imagedestroy($sourceImage);
}
}