File Upload to MYSQL, some files don't upload properly 1

[laurin1]

I can upload .PDF and HTML files just fine, but when I try to upload anything else (.jpg, .txt, .xls), the file gets messed up. When I download the file, it's damaged and won't open properly.

Help!

 

[laurin1]

CORRECTION:

I just checked the files using Query Browser and the file downloads fine from there. So the file uploads correctly and is stored in the database correctly. The problem must be in my download code:

<?php session_start();
require_once('connections/local.php');
require_once('library/common.php');

if(isset($sFileID)){

	$sql 	= "SELECT name, type, size, file FROM files WHERE id=" . $sFileID;
	$result 	= mysql_query($sql) or die('Error, query failed');
	$array 	= mysql_fetch_array($result);
	
	header("Content-length: " . $array['size']);
	header("Content-type: " . $array['type']);
	header("Content-Disposition: attachment; filename=" . $array['name']);
	echo $array['file'];
		
	}

?>

 

[jpadie]

try adding

set_magic_quotes_runtime(0);

to the start of your code. i'm surprised that some types of binary file work and that txt files do not. i'd also suspect that the problem is in your upload script rather than download but checking magic quotes is a good starting point.

 

[laurin1]

I tried this, but they still don't work. I'm certain it's not the upload, as I can download the files from the MySQL Query Browser just fine.

Keith Davis
MCSA, A+, N+, Guru+, Geek+, Child of God++++++
Love and Service

 

[jpadie]

try forcing the mimetype to application/octet-stream

 

[laurin1]

How do I do that?

Keith Davis
MCSA, A+, N+, Guru+, Geek+, Child of God++++++
Love and Service

 

[jpadie]

change

header("Content-type: " . $array['type']);

to

header("Content-type: application/octet-stream");

 

[laurin1]

Ok, that's what I thought. I tried that and it has no effect. PDF and text documents work fine, everything other file type does not download correctly.

Keith Davis
MCSA, A+, N+, Guru+, Geek+, Child of God++++++
Love and Service

 

[jpadie]

ok try this script instead (i'm assuming that you are populating the $sFileID somehow outside the script):

session_start();
require_once('connections/local.php');
require_once('library/common.php');

if(isset($sFileID)){

    $sql     = "SELECT name, type, size, file FROM files WHERE id=" . $sFileID;
    $result     = mysql_query($sql) or die('Error, query failed');
    $array     = mysql_fetch_array($result);
    header("Content-Length: " . strlen($array['file'])  );
    header("Content-Type: application/octet-stream");
    header('Content-Disposition: attachment; filename="'.$array['name'].'"');
header("Content-Transfer-Encoding: binary\n");
echo $array['file'];
}

 

[laurin1]

That did not work either. I just checked a bitmap I uploaded and the file size of the one I downloaded is 4 bytes larger than the one I uploaded. What could it be adding?

Keith Davis
MCSA, A+, N+, Guru+, Geek+, Child of God++++++
Love and Service

 

[laurin1]

Oh, and I looked in the MySQL table and the file size is correct there. When I download it from the Query Browser the file size is also correct. Something is being added upon download.

Keith Davis
MCSA, A+, N+, Guru+, Geek+, Child of God++++++
Love and Service

 

[laurin1]

Also, I did this to the code and it reports the right number:

<?php 
session_start();
require_once('connections/local.php');
require_once('library/common.php');

if(isset($sFileID)){

	$sql		= "SELECT name, type, size, file FROM files WHERE id=" . $sFileID;
	$result	= mysql_query($sql) or die('Error, query failed');
	$array	= mysql_fetch_array($result);

	echo strlen($array['file']);

	}

?>

Keith Davis
MCSA, A+, N+, Guru+, Geek+, Child of God++++++
Love and Service

 

[jpadie]

Keith

i can't see why there should be errors but you have not provided your upload script or form definition. the fact that another php application (like phpmyadmin) may work is not necessarily conclusive that the file upload is not to blame.

in any event, i have written an upload, download and management script and posted it to my webserver for you to try. the source code is also present if you want to recreate the applet on your own servers.

http://www.tmogolf.co.uk/tektips/thread434-1234802/index.php

Justin

 

[laurin1]

I disagree. If the file size is correct in MySQL, but is not after download via a script, I believe that the upload is not to blame. Here is my upload script:

elseif($cmdSubmit == 'Attach'){
		
		if($_FILES['Attach']['size'] > 0) {
			
			$sFileName 	= $_FILES['Attach']['name'];
			$sTmpName  	= $_FILES['Attach']['tmp_name'];
			$sFileSize 	= $_FILES['Attach']['size'];
			$sFileType 	= $_FILES['Attach']['type'];
			$fp			= fopen($sTmpName, 'r');
			$sContent		= fread($fp, filesize($sTmpName));
			$sContent		= addslashes($sContent);
			fclose($fp);
			$sFileName 	= addslashes($sFileName);
			
			$sql 	= "SELECT * FROM files WHERE name='" . $sFileName . "' AND caseid=" . $id;
			$result	= mysql_query($sql) or die('SQL to find same file names failed');
			
			if(mysql_num_rows($result) > 0){
			
				$sql = "DELETE FROM files WHERE name='" . $sFileName . "' AND caseid=" . $id;
				mysql_query($sql) or die('Deletion of duplicate file failed');
				
				}
				
			$sql 	= "INSERT INTO files SET name='" . $sFileName . "', size='" . $sFileSize . "', type='"
					. $sFileType . "', modified_date=NULL, create_date=NULL, file='" . $sContent 
					. "', caseid='" . $id . "'";
			mysql_query($sql) or die('Upload Failed');
		
			}
			
		elseif($_FILES['name'] != '') echo 'Upload Failed';
	
		}

			<FORM ENCTYPE="MULTIPART/FORM-DATA" METHOD="POST" ACTION="<?=$_SERVER['PHP_SELF']?>" NAME="frmFiles">
				<INPUT TYPE="HIDDEN" NAME="MAX_FILE_SIZE" VALUE="5000000">
				<INPUT TYPE="HIDDEN" NAME="id" VALUE="<?=$id?>">
				<INPUT TYPE="FILE" NAME="Attach">
				<INPUT TYPE="SUBMIT" NAME="cmdSubmit" VALUE="Attach">
			</FORM>

Keith Davis
MCSA, A+, N+, Guru+, Geek+, Child of God++++++
Love and Service

 

[jpadie]

i still think it is your upload script.

try changing these lines

$fp            = fopen($sTmpName, 'r');
$sContent        = fread($fp, filesize($sTmpName));
$sContent        = addslashes($sContent);
fclose($fp);

to either

$fp            = fopen($sTmpName, 'rb'); //make binary safe
$sContent        = fread($fp, filesize($sTmpName));
$sContent        = addslashes($sContent);
fclose($fp);

or

$sContent        = file_get_contents($sTmpName);
$sContent        = addslashes($sContent);

i recomment mysql_escape_string over addslashes and mysql_real_escape_string over the former.

 

[jpadie]

Keith

i have replicated your code on my server too

http://www.tmogolf.co.uk/tektips/thread434-1234802/index-2.php

i have indicated in the code where i have changed things from the code that you posted above. It appears to be working so far as I can discern.

Justin

 

[laurin1]

I just tried both methods you described and with mysql_real_escape_string and that did not solve my problem.

I just copied the code from your server, which works fine on your server, but it does not work on my server (same problem.) Maybe it's something in my server configuration.

Keith Davis
MCSA, A+, N+, Guru+, Geek+, Child of God++++++
Love and Service

 

[jpadie]

something on your server]

i guess that's all we're left with. most likely a php.ini directive perhaps?

 

[laurin1]

Ok. I'm a little closer to a solution. I was able to open one of the downloaded files in word and could read some errors at the top (php errors.) I added

 error_reporting(0);

to your code and the page you created works on my server. My code is still not working, but I'm willing to bet it's the same problem. It seems when I'm downloading the file, the error messages are being addded to the file, causing it to contain invalid data.

Keith Davis
MCSA, A+, N+, Guru+, Geek+, Child of God++++++
Love and Service

 

[laurin1]

Ok, it wasn't the errors on my download.php, it was common.php. It was sticking some data at the top of the file. I removed it and whala!!!

I should have caught that.

Thanks everyone for all your help, especially you, jpadie!

Keith Davis
MCSA, A+, N+, Guru+, Geek+, Child of God++++++
Love and Service