php Upload Function help please

[freecrm]

My Site is a customer relationship management system, fully written from scratch.

Within it is a function to import existing contact details (.csv file) into the DB. However, this relies on the file_get_contents from a URL, which means that a user has to have their .csv uploaded to a server.... which many won't have a clue how to do.

What I would prefer is for them to just upload a file from their system and then the code loads the data from that temporary file.

I know this is probably possible but don't have clue where to start.

Any assistance is appreciated.

[misson]

This is where to start: "Handling file uploads".

[freecrm]

This is where to start: "Handling file uploads".

OK - thanks for the starting point. This page didn't exactly help, but it did lead me to a similar helpful one...

I now have a 3 page process.

1) upload file to tmp dir

<form action="datapreview.php" method="post" enctype="multipart/form-data" name="form1" id="form1">
    <label>
    <input type="hidden" name="MAX_FILE_SIZE" value="30000" />
    <input name="userfile" type="file" size="80" />
    </label>
    <p>
      <label>
      <input type="submit" name="button" id="button" value="Upload" />
      </label>
    </p>
  </form> 

2) Check data and preview

<h2>File Information</h2>
<br />
File Name: <?php echo $_FILES['userfile']['name'];?>
  <br />
File Type: <?php echo $_FILES['userfile']['type'];?>
<br/>
File Size (bytes): <?php echo $_FILES['userfile']['size'];?>
<br/>
Temp Uploaded File Name: <?php echo $_FILES['userfile']['tmp_name'];?>
<br/>
Error Code: <?php echo $_FILES['userfile']['error'];?>
<br/>
<br/>
<h2>Preview Data to be imported</h2>
<?php
$filecontent = file_get_contents($_FILES['userfile']['tmp_name']);
echo "<br/>";
print_r($filecontent);
?>

3) import into DB

Don't think I'll have any problems here.

My questions are..

a) how do I verify that the file is .csv format?
b) on page 2, how do I get the data to preview in tabular format? Will this have to be on a loop and create rows based on exploding by /n?
c) what happens to the temporary file? Is it automatically deleted on browser closure?

[lemon-tree]

a) Look for the features that make it a .csv file and just verify. Firstly, check file extension. Secondly, is the format correct. Finally, use strip_tags() and make sure the file does not pose a security risk.
b) Just loop through, replacing the blanks
c) The server deletes it after the PHP execution completes

[misson]

OK - thanks for the starting point. This page didn't exactly help, but it did lead me to a similar helpful one...

Which is the point of the page. As the entry point for the PHP file upload documentation, it links to specific subject pages.

<form action="datapreview.php" method="post" enctype="multipart/form-data" name="form1" id="form1">
    <label>
    <input type="hidden" name="MAX_FILE_SIZE" value="30000" />
    <input name="userfile" type="file" size="80" />
    </label> 

The <label> element is supposed to contain a label for a form control, not a form control itself. Why are you using them as <input> containers?
Example:

<form action="datapreview.php" method="post" enctype="multipart/form-data" name="form1" id="form1">
    <label for="userfile">File:</label>
    <input name="userfile" type="file" size="80" />
...

I also don't recommend using the "MAX_FILE_SIZE" form variable even though it shows up in the PHP documentation examples. Form variables shouldn't contain trusted data and the only way of validating that particular value is to store the same information server side.

c) what happens to the temporary file? Is it automatically deleted on browser closure?

Note that c) is answered immediately above the last example on the POST method uploads page.

[freecrm]

Thanks for the info - I'm working on this part by part.

First - getting the file extention. I've tried using pathinfo, but for some reason, the extention part of the array is not supported by the x10 version. Any ideas?

i.e. $pathinfo = pathinfo($_FILES['userfile']['tmp_name'], PATHINFO_EXTENSION);

I've also tried to split it off using $ext = $pathinfo['extension']; but got nowhere.

In fact, if you print_r the array, there is nothing there containing the extension information!

I have used strip_tags as suggested as this could be a problem (although if it remains in the /tmp/ directory, surely if this is not public access, it wouldn't cause a problem.

I've also pretty much done the loop.

Thanks for the help so far.

[lemon-tree]

I have used strip_tags as suggested as this could be a problem (although if it remains in the /tmp/ directory, surely if this is not public access, it wouldn't cause a problem.

Very true, but I just do it as a safety precaution, you shouldn't really have to do it.

To get the extension, I generally just split the string by the '.' and look at the last item in the array.

[misson]

First - getting the file extention. I've tried using pathinfo, but for some reason, the extention part of the array is not supported by the x10 version. Any ideas?

i.e. $pathinfo = pathinfo($_FILES['userfile']['tmp_name'], PATHINFO_EXTENSION);

The temporary name is pseudo-random and not based on the original file name. Use $_FILES['userfile']['name'] to get the original file name, including extension.

[freecrm]

That would explain a lot - thanks.

I have now completed the preview page but am struggling to get my head around how to validate the format.

I think I can also use a character count to establish a size restriction.

I'll get there I'm sure.

[misson]

I have now completed the preview page but am struggling to get my head around how to validate the format.

The standard approach would be to parse the file and throw an exception if the parse fails. For CSV files, use fgetcsv() to parse the next line & then check that the number of fields is correct. If fgetcsv() fails, make sure you use feof() to check whether you've reached EOF or had a parse error.