<form enctype="multipart/form-data" method="post" action="upload_script.php">
<input type = "hidden" name = "; MAX_FILE_SIZE "value =" 1000 ">
Select file: <input name="imya_polya" type="file">
<input type="submit" value="Poslat fayl">
</ form>

</ div>

Necessary to specify <form enctype="multipart/form-data" method="post"...> and very desirable <input type="hidden" name="MAX_FILE_SIZE" value="XXXX"> prior to input file la.

When these conditions are met, you can write a script that will handle uploading files.

PHP version 3 was not the function move_uploaded_file ()therefore, before the fourth version of ispollzovalas function copy () which is still in the documentation and is very popular. Extremely undesirable to use the copy () files when injected as may be many bugs. copy () will not work when includingyuchennom open_basedir!! In safe_mode = On to use the copy () must be installed on the temporary folder of the same and that the OWNER is the script, ie apload it would be impossible to do if you have multiple users (as it should be in the case of virtual domains). Also copy ()checks the file does not exist, does not return

Possible bugs

1. file_uploads = Off in php.ini. Downloading files is prohibited
   
2. No rights for $ storage = "/ home / www / public_html / uploads /". Chown Change the userwhich is running the script, or put in a folder chmod 0777
   
3. Target directory is different than the owner of which is running PHP, when safe_mode = On. It is widely distributed case for hosting a ball, when the user Apache for example, www or nobody,while access to FTP, for example, to pupkin. Exit the two:
   
   
   
   • Chisel support service for adjusting the same users on the FTP and Apache (for your virtual domain).
     
   • Folder to download to create a script under Apache, and put it 'chmod 0777'. Then you will be able to raBot of the script bypassing safe_mode restrictions and edit files on FTP.
     
   
   
4. No rights to upload_tmp_dir =; (setting in php.ini). Put chmod 0777 on this folder.
   
5. Files can be spoiled if Apache is running under some modules, such as mod_charset(Also known as Russian Apache). Turn off it for certain files:
   

   
   <Files Upload.php> <br>
   CharsetDisable On <br>
   </ Files>

   
   
6. Do not upload large files. The reasons may be several, if not carried out anyOne of the conditions of the file does not begin:
   
   
   
   • File size more than $ _POST [ 'MAX_FILE_SIZE']
     
   • File size more than upload_max_filesize = 2M (php.ini)
     
   • File size more than post_max_size = 8M (php.ini)
     
   • Size greater LimitRequestBody (httpd.conf)
     Running low on disk space or upload_tmp_dir = or on the target directory
     
   • Execution time has exceeded the max_execution_time = (php.ini)
     
   • Time Script Timeout exceeded 30 (httpd.conf)
     
   • Execution time has exceeded timeout for CGI (Consol IIS)
     
   
   
7. The user is sitting behind a proxy which prohibits the transfer of
8. You use a different method of injection, as in this article, such as abbreviated syntax, but that register_globals = Off or an old version of PHP, or even worse - studyusing copy () instead of move_uploaded_file ().
   
9. Does not work $ HTTP_POST_FILES [$ field_name] [ 'type']. This is not a bug PHP, this parameter is passed a browser, so that they never rely on it.
   
10. Problems with injection NEbrouzernoy file (not URI encoded form). In mosttion of cases that would use $ HTTP_RAW_POST_DATA
    
11. Problems with injection zero-length files. The crux of the problem is not that the files do not download from that and that it is impossible to begin to determine whether the file really is. Many people check the status of the download through the $ HTTP_POST_FILES[$ field_name] [ 'size'] but in the case when a file does not begin, and in case of an empty file, the variable will be equal to 0. If the user prints out the name of nonexistent file in the browser, he was transferred as a file of zero length. Check this means PHP is not allowed.
    
12. magic_quotes_gpc= On and stripslashes to Win platform will create problems in obtaining the names of files, for example $ HTTP_POST_FILES [$ field_name] [ 'size'] does soderazht should double back-slash.
    
13. Incorrect parameters transferred to the move_uploaded_file (). There must be something like:
    
    
    <? php
    / / Correct syntax
    move_uploaded_file (
    '/ var / php_tmp_upload / userfile.jpg' font>,
    '/ home / pupkin / public_html / userfile.jpg'
    );
    
    / / Wrong syntax
    move_uploaded_file (
    'userfile.jpg',
    '/ home / pupkin / public_html / userfile.jpg'
    );
    >