Can I enable upload a pdf file with php ?

[jeddiki]

Hello,

Hopefully I can do this with php

I want to allow my clients to upload their pdf or video files to my server without giving them ftp login details.

Lets look at PDF's first:

This must be similar code to uploading an image - same thing really - just the checking must be different I guess?

This is what I have for the form:
I think that I have specified 10Mb and the max ( maybe that's a bit low ? )

/*
*  upload_fm.php
*
*/
<form name="main_fm" enctype ="multipart/form-data" action ='upload_check.php' method = 'POST'>
<input type = 'hidden' name='upld' value="on">
<input type="hidden" name ="MAX FILE SIZE" value="10000000">
<b>Your PDF:</b><br>
<input type="file" size="50" id = "u1" name="upLoad">
<input type="submit" value="Upload PDF">
</form>

So far I have this to check the pdf but I have no idea how to proceed from here

I guess that I need to check somehow that it is a PDF and not some horrible virus program!

Then I need to move the file to a directory so that it can be access by another script to allow downloading.

Let's say that I want to put it on /MyPDF directory so the path will be
/MyPDF/nameofPDF.pdf

Would really appreciate any help

/*
*   upload_check.php
*
*/

$N_pdf  =    $_FILES['upLoad']["name"];
        
        
// possible PHP upload errors 
$errors = array(1 => 'php.ini max file size exceeded', 
                2 => 'html form max file size exceeded', 
                3 => 'file upload was only partial', 
                4 => 'no file was attached'); 

if ($_FILES['upLoad']['error'] != 0) { 
        $message1 = "PDF file did not successfully upload" ; 
        $message2 =  "Error: ".$errors[$_FILES['upLoad']['error']]; 
        require_once ("upload_fm.php"); 
        exit(); 
}  // endif

Thanks for any input

[Atli]

Hi.

Yes, the process of uploading a PDF is pretty much the same as uploading an Image.
The only difference is the validation process.

There are a few things you can check to see if it is in fact a PDF file, but there is never a way to be 100% sure.
The best defence against harmful files is to put them somewhere they can't be accessed by outsiders. (Outside the web-root)

Personally, to validate a PDF file, I would consider these steps sufficient:

1. Make sure the mime type is "applicatio n/pdf"
2. Make sure the file extension is .pdf
3. Make sure the first 5 bytes of the file read "%PDF-" (As per the standard)

This should at least prevent accidental uploads of invalid files, and attempts to upload non-pdf files.

If all that checks out, the move_uploaded_f ile function should take care of the rest.

[jeddiki]

Thanks very much for your advice,
I think I can move forward on this now :)