PHP文件上传代码修复请求：指定路径保存文件报错问题咨询（新手学习者求助）

Hey there! Let's walk through fixing your file upload code step by step, since you're just starting out with PHP. First, let's break down the issues in your original code, then I'll share the fixed version and explain all the key concepts so you understand what's going on.

Issues in Your Original Code #

1. Messy HTML structure: You closed the <body> and <html> tags before the rest of your content, which would cause rendering problems in browsers.
2. No specified upload path: You were saving files directly to the same directory as your script, which is unsafe and doesn't meet your "save to a specified path" requirement.
3. Overuse of error suppression (@): This hides useful debug messages, making it harder to figure out why things are breaking.
4. Missing security checks: No validation for file size, type, or whether the file was actually uploaded via a form (leaving you open to malicious uploads).
5. No handling for missing upload directories: If your target folder doesn't exist, the upload will fail silently.

Fixed & Improved Code #

<?php
// Configure upload settings
$uploadDir = './uploads/'; // Specify your target directory (keep the trailing slash)
$maxFileSize = 2 * 1024 * 1024; // Max file size: 2MB
$allowedTypes = ['image/jpeg', 'image/png', 'image/gif', 'application/pdf']; // Allowed MIME types

// Handle upload submission
if (isset($_POST['submit']) && $_POST['submit'] === "Upload File") {
    // Check if a file was uploaded without errors
    if (!isset($_FILES['users']) || $_FILES['users']['error'] !== UPLOAD_ERR_OK) {
        $errorMsg = match ($_FILES['users']['error']) {
            UPLOAD_ERR_INI_SIZE => 'File exceeds php.ini size limit',
            UPLOAD_ERR_FORM_SIZE => 'File exceeds form size limit',
            UPLOAD_ERR_PARTIAL => 'File was only partially uploaded',
            UPLOAD_ERR_NO_FILE => 'No file was selected',
            UPLOAD_ERR_NO_TMP_DIR => 'Server missing temporary directory',
            UPLOAD_ERR_CANT_WRITE => 'Failed to write file to disk',
            UPLOAD_ERR_EXTENSION => 'Upload blocked by a PHP extension',
            default => 'Upload failed with error code: ' . $_FILES['users']['error'],
        };
        echo "<strong>Sorry, {$errorMsg}</strong><br />";
        exit;
    }

    $uploadedFile = $_FILES['users'];
    $safeFileName = basename($uploadedFile['name']); // Sanitize file name to prevent path attacks
    $targetPath = $uploadDir . $safeFileName;

    // Create upload directory if it doesn't exist
    if (!is_dir($uploadDir)) {
        mkdir($uploadDir, 0755, true); // 0755 = owner read/write/execute, others read/execute; true = create parent folders if needed
    }

    // Validate file size
    if ($uploadedFile['size'] > $maxFileSize) {
        echo "<strong>Sorry, file size exceeds limit (max 2MB)</strong><br />";
        exit;
    }

    // Validate file type
    if (!in_array($uploadedFile['type'], $allowedTypes)) {
        echo "<strong>Sorry, only JPG, PNG, GIF, and PDF files are allowed</strong><br />";
        exit;
    }

    // Verify the file was actually uploaded via HTTP POST (security check)
    if (!is_uploaded_file($uploadedFile['tmp_name'])) {
        echo "<strong>Warning: Not a valid uploaded file</strong><br />";
        exit;
    }

    // Check if file already exists
    if (file_exists($targetPath)) {
        echo "<strong>{$safeFileName} already exists. Please rename the file and try again.</strong>";
    } else {
        // Move temporary file to target directory
        if (move_uploaded_file($uploadedFile['tmp_name'], $targetPath)) {
            echo "<strong>File uploaded successfully! Saved to: {$targetPath}</strong>";
        } else {
            echo "<strong>Failed to upload {$safeFileName}. Please check directory write permissions.</strong>";
        }
    }
}
?>
<!DOCTYPE html>
<html>
<head>
    <title>File Uploader</title>
</head>
<body>
    <form enctype="multipart/form-data" name="frmUpload" method="post" action="">
        Select a file to upload:<br />
        <!-- Frontend restrictions (optional but improves user experience) -->
        <input type="file" name="users" accept=".jpg,.png,.gif,.pdf"><br /><br />
        <input type="submit" name="submit" value="Upload File">
    </form>
</body>
</html>

Key Concepts Explained #

1. HTML Form Requirements

   • enctype="multipart/form-data": Mandatory for file uploads—it tells the server to handle binary file data.
   • method="POST": GET requests can't handle large files and aren't designed for uploads.
   • accept attribute: Limits the file types users can select in their browser (always add backend validation too, since frontend checks can be bypassed).

2. The $_FILES Superglobal

   • $_FILES['users']['name']: Original name of the uploaded file.
   • $_FILES['users']['tmp_name']: Temporary path where PHP stores the file on the server. You must move this with move_uploaded_file() before the script ends, otherwise it gets deleted.
   • $_FILES['users']['error']: Numeric code for upload errors (we used constants like UPLOAD_ERR_OK to make errors easier to read).

3. Safe Upload Path Handling

   • basename($safeFileName): Removes any directory paths from the file name, preventing attackers from uploading files to sensitive folders (like ../../etc/passwd).
   • mkdir($uploadDir, 0755, true): Creates your target directory if it doesn't exist. The 0755 permission ensures the server can write to it while keeping it secure.

4. Security Checks

   • File size validation: Prevents oversized files from filling up server storage.
   • File type validation: Restricts uploads to only the types you need (avoids malicious scripts being uploaded).
   • is_uploaded_file(): Ensures the file was actually uploaded via a form, not manually injected into the $_FILES variable by an attacker.

5. Error Handling

   • We removed the @ error suppressor—it hides critical info like permission issues. Instead, we check specific error codes and give clear feedback.

Extra Tips for Production #

• Rename files: Add a timestamp or random string to the file name (e.g., time() . '_' . $safeFileName) to avoid overwriting existing files.
• Validate file content: For images, use getimagesize() to confirm it's a real image (MIME types can be faked).
• Set proper permissions: Make sure the uploads directory is owned by the server user (like www-data on Apache) so PHP can write to it.

内容的提问来源于stack exchange，提问作者Ahmar Safi