php - 上传文件到用户文件夹

Question

我正在尝试在上传文件夹中创建一个新文件夹，以便用户可以将文件上传到自己的文件夹。我可以使用 PHP 执行此操作还是需要在 MYSQL 中添加“LONGBLOB”列？我读到将图像存储在数据库中不是好的做法

<?php
header('Content-Type: application/json');

$succeeded = [];
$failed =[];
$uploaded = [];
$allowed = ['png', 'gif', 'jpg'];

if(!empty($_FILES["file"])) {

    foreach ($_FILES['file']['name'] as $key => $name) {
        if ($_FILES['file']['error'][$key] === 0) {

            $temp = $_FILES['file']['tmp_name'][$key];

            $ext = explode('.', $name);

            $ext = strtolower(end($ext));

            $file = md5_file($temp) . time() . '.' . $ext;

            if (in_array($ext, $allowed) === true && move_uploaded_file($temp, "uploads/{$file}") === true) {
                $succeeded[] = array(
                                'name' => $name,
                                'file' => $file
                                );

            }else{
                $failed[] = array(
                    'name' => $name);
            }
        }
    }


}

if (!empty($_POST['ajax'])) {
    echo json_encode(array(
        'succeeded' => $succeeded,
        'failed' => $failed ));
}



?>

Answer 1

假设您在 session 变量中有用户的用户名或 ID，则可以将其用作他/她将上传文件的新文件夹的基础。显然，当他们希望下载文件时，必须使用相同的用户名和 ID。通过存储散列和文件路径，您可以生成不显示文件名、文件夹路径、所有者等的链接，因为数据库可以检查散列并在需要时返回文件和路径。

以下是生成用户自己的文件夹并在上传过程中使用的未经测试的示例 - 希望它能给您一些想法/指导。

<?php


    $succeeded = [];
    $failed =[];
    $uploaded = [];
    $allowed = ['png', 'gif', 'jpg'];


    /*
        generate a suitable name for the new folder, 
        remove characters which might be troublesome
    */
    $userdir = str_replace( 
        array("'",'"','-'),
        array('','','_'),
        $_SESSION['username']
    );



    /* 
        new path into which the files are saved
        It might be better to have the files 
        stored outside of the document root.
    */
    $savepath = 'uploads/' . $userdir;



    /* create the folder if it does not exist */
    if( !file_exists( $savepath ) ) {
        mkdir( $savepath );
        chown( $savepath, $username );
        chmod( $savepath, 0644 );
    }



    if( !empty( $_FILES["file"] ) ) {

        foreach( $_FILES['file']['name'] as $key => $name ) {
            if( $_FILES['file']['error'][$key] === 0 ) {

                $temp = $_FILES['file']['tmp_name'][$key];

                /*
                    is there anything to be gained by hashing the filename?
                    the hash would be the same for filenames with the same 
                    name anyway.

                    If the file is large, calculating the hash of the file could
                    take some time...
                */
                $ext = explode('.', $name);
                $ext = strtolower( end( $ext ) );
                $file = md5_file( $temp ) . time() . '.' . $ext;


                /* generate a random hash to use in downloads */
                $hash=uniqid( md5( date(DATE_COOKIE) ) ); 


                /* here probably - store reference in db? Assign permissions based upon owner etc */
                $sql='insert into `table` (`filename`,`username`,`uid`,`datetime`,`hash`) values (?,?,?,?,?);';             

                /* bind params and execute - not shown */



                if ( in_array( $ext, $allowed ) === true && move_uploaded_file( $temp, "{$savepath}/{$file}") === true ) {
                    $succeeded[] = array( 'name' => $name, 'file' => $file );
                }else{
                    $failed[] = array( 'name' => $name );
                }
            }
        }
    }

    if (!empty($_POST['ajax'])) {

        header('Content-Type: application/json');
        echo json_encode(array(
            'succeeded' => $succeeded,
            'failed' => $failed ));
    } else {

        header( 'HTTP/1.1 404 Not Found', true, 404 );
    }
?>