php $maxFileSize) { $errorMessages[] = "Error uploading '{$safeFileName}': File exceeds the maximum size limit (" . ($maxFileSize / 1024 / 1024) . " MB)."; continue; } // Check MIME type (if $allowedMimeTypes is configured) if (!empty($allowedMimeTypes)) { // More reliable check using server-side detection $finfo = finfo_open(FILEINFO_MIME_TYPE); $actualMimeType = finfo_file($finfo, $fileTmpName); finfo_close($finfo); if (!in_array($actualMimeType, $allowedMimeTypes)) { $errorMessages[] = "Error uploading '{$safeFileName}': File type '{$actualMimeType}' is not allowed."; continue; } } // --- Move the File --- if (move_uploaded_file($fileTmpName, $targetFilePath)) { $successMessages[] = "Successfully uploaded '{$safeFileName}'."; } else { $errorMessages[] = "Error uploading '{$safeFileName}': Failed to move uploaded file. Check server logs and permissions."; } } } // else: Error message about unwritable directory already added } elseif ($_SERVER['REQUEST_METHOD'] === 'POST') { $errorMessages[] = "No files were selected for upload."; } /** * Translates PHP upload error codes into human-readable messages. * * @param int $errorCode The UPLOAD_ERR_* constant. * @return string The error message. */ function getUploadErrorMessage(int $errorCode): string { switch ($errorCode) { case UPLOAD_ERR_INI_SIZE: return "The uploaded file exceeds the upload_max_filesize directive in php.ini."; case UPLOAD_ERR_FORM_SIZE: return "The uploaded file exceeds the MAX_FILE_SIZE directive specified in the HTML form."; case UPLOAD_ERR_PARTIAL: return "The uploaded file was only partially uploaded."; case UPLOAD_ERR_NO_FILE: return "No file was uploaded."; case UPLOAD_ERR_NO_TMP_DIR: return "Missing a temporary folder."; case UPLOAD_ERR_CANT_WRITE: return "Failed to write file to disk."; case UPLOAD_ERR_EXTENSION: return "A PHP extension stopped the file upload."; default: return "Unknown upload error."; } } ?> Multiple File Upload

Upload Multiple Files

Max file size: MB.

Allowed types:

<?php /** * Handles multiple file uploads. */ // --- Configuration --- $uploadDirectory = 'uploads/'; // Relative path to the upload directory $maxFileSize = 5 * 1024 * 1024; // 5 MB (adjust as needed) $allowedMimeTypes = [ // Optional: restrict file types // 'image/jpeg', // 'image/png', // 'application/pdf', ]; // --- End Configuration --- $uploadMessages = []; $errorMessages = []; $successMessages = []; // --- Create Upload Directory --- if (!is_dir($uploadDirectory)) { // Attempt to create the directory recursively if (!mkdir($uploadDirectory, 0755, true)) { // Check again if it exists (race condition) or failed if (!is_dir($uploadDirectory)) { $errorMessages[] = "Error: Failed to create the upload directory '{$uploadDirectory}'. Please check permissions or create it manually."; } } else { $uploadMessages[] = "Upload directory '{$uploadDirectory}' created."; } } // Check writability *after* attempting creation if (is_dir($uploadDirectory) && !is_writable($uploadDirectory)) { $errorMessages[] = "Error: The upload directory '{$uploadDirectory}' exists but is not writable. Please check permissions."; } // --- Handle Form Submission --- // Proceed only if there are no initial directory errors if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['filesToUpload']) && empty($errorMessages)) { $uploadedFiles = $_FILES['filesToUpload']; // Normalize the $_FILES array structure for easier iteration $files = []; if (is_array($uploadedFiles['name'])) { foreach ($uploadedFiles['name'] as $key => $name) { if ($uploadedFiles['error'][$key] !== UPLOAD_ERR_NO_FILE) { // Only process actual uploads $files[] = [ 'name' => $name, 'type' => $uploadedFiles['type'][$key], 'tmp_name' => $uploadedFiles['tmp_name'][$key], 'error' => $uploadedFiles['error'][$key], 'size' => $uploadedFiles['size'][$key], ]; } } } elseif ($uploadedFiles['error'] !== UPLOAD_ERR_NO_FILE) { // Handle single file upload case just in case 'multiple' is removed from HTML $files[] = $uploadedFiles; } if (empty($files) && $_SERVER['REQUEST_METHOD'] === 'POST') { $errorMessages[] = "No files were selected or uploaded successfully."; } foreach ($files as $file) { // --- Basic File Info --- $fileName = basename($file['name']); // Basic security $fileTmpName = $file['tmp_name']; $fileSize = $file['size']; $fileError = $file['error']; $fileType = $file['type']; // MIME type reported by browser // --- Error Checking --- if ($fileError !== UPLOAD_ERR_OK) { $errorMessages[] = "Error uploading '{$fileName}': " . getUploadErrorMessage($fileError); continue; // Skip to next file } // --- Security Checks --- // Sanitize filename (more robust) $pathInfo = pathinfo($fileName); $baseName = preg_replace("/[^\w.-]/", "_", $pathInfo['filename']); // Allow word chars, dots, hyphens $extension = isset($pathInfo['extension']) ? '.' . strtolower($pathInfo['extension']) : ''; // Prevent files starting with dot (hidden files), or having no name if (empty($baseName) || $baseName[0] === '.') { $errorMessages[] = "Error uploading '{$fileName}': Invalid filename."; continue; } $safeFileName = $baseName . $extension; if ($safeFileName !== $fileName) { $uploadMessages[] = "Notice: Filename '{$fileName}' sanitized to '{$safeFileName}'."; } $targetFilePath = $uploadDirectory . $safeFileName; // Prevent directory traversal (redundant with basename but good practice) if (strpos($targetFilePath, '../') !== false || strpos($targetFilePath, "..\\") !== false) { $errorMessages[] = "Error uploading '{$safeFileName}': Invalid file path."; continue; } // Prevent overwriting existing files (add counter if needed) $counter = 0; $originalTargetFilePath = $targetFilePath; while (file_exists($targetFilePath)) { $counter++; $targetFilePath = $uploadDirectory . $baseName . '_' . $counter . $extension; // Safety break to prevent infinite loops in edge cases if ($counter > 100) { $errorMessages[] = "Error uploading '{$safeFileName}': Too many files with the same name exist."; // Break outer loop? Or just continue? Continuing for now. continue 2; // Continue the outer foreach loop } } if ($targetFilePath !== $originalTargetFilePath) { $uploadMessages[] = "Notice: File '{$safeFileName}' renamed to '" . basename($targetFilePath) . "' to avoid overwrite."; $safeFileName = basename($targetFilePath); // Update safeFileName for messages } // Check file size if ($fileSize > $maxFileSize) { $errorMessages[] = "Error uploading '{$safeFileName}': File exceeds the maximum size limit (" . formatBytes($maxFileSize) . ")."; continue; } // Check MIME type (if $allowedMimeTypes is configured) if (!empty($allowedMimeTypes)) { // More reliable check using server-side detection $finfo = finfo_open(FILEINFO_MIME_TYPE); $actualMimeType = finfo_file($finfo, $fileTmpName); finfo_close($finfo); if (!in_array($actualMimeType, $allowedMimeTypes)) { $errorMessages[] = "Error uploading '{$safeFileName}': File type '{$actualMimeType}' is not allowed."; continue; } } // --- Move the File --- if (move_uploaded_file($fileTmpName, $targetFilePath)) { $successMessages[] = "Successfully uploaded '{$safeFileName}' (" . formatBytes($fileSize) . ")."; } else { // Provide more context if possible $lastError = error_get_last(); $extraInfo = $lastError ? " System error: " . $lastError['message'] : ""; $errorMessages[] = "Error uploading '{$safeFileName}': Failed to move uploaded file. Check server logs and permissions.{$extraInfo}"; } } // end foreach } elseif ($_SERVER['REQUEST_METHOD'] === 'POST' && empty($errorMessages)) { // This condition might be hit if $_FILES is empty but it was a POST request // without initial directory errors. $errorMessages[] = "No files were received for upload. The form might be misconfigured or the request was empty."; } /** * Translates PHP upload error codes into human-readable messages. * * @param int $errorCode The UPLOAD_ERR_* constant. * @return string The error message. */ function getUploadErrorMessage(int $errorCode): string { switch ($errorCode) { case UPLOAD_ERR_INI_SIZE: return "File exceeds the server's maximum upload size (upload_max_filesize)."; case UPLOAD_ERR_FORM_SIZE: return "File exceeds the form's maximum upload size (MAX_FILE_SIZE)."; case UPLOAD_ERR_PARTIAL: return "File was only partially uploaded."; case UPLOAD_ERR_NO_FILE: // This case is usually handled before calling this function return "No file was uploaded."; case UPLOAD_ERR_NO_TMP_DIR: return "Server configuration error: Missing temporary folder."; case UPLOAD_ERR_CANT_WRITE: return "Server configuration error: Failed to write file to disk."; case UPLOAD_ERR_EXTENSION: return "A PHP extension stopped the file upload."; default: return "Unknown upload error (Code: {$errorCode})."; } } /** * Formats bytes into a human-readable string (KB, MB, GB). * * @param int $bytes The number of bytes. * @param int $precision The number of decimal places. * @return string The formatted size. */ function formatBytes(int $bytes, int $precision = 2): string { $units = ['B', 'KB', 'MB', 'GB', 'TB']; $bytes = max($bytes, 0); $pow = floor(($bytes ? log($bytes) : 0) / log(1024)); $pow = min($pow, count($units) - 1); $bytes /= pow(1024, $pow); return round($bytes, $precision) . ' ' . $units[$pow]; } ?> <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Multiple File Upload</title> <style> body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji", "Segoe UI Symbol"; line-height: 1.6; padding: 20px; max-width: 700px; margin: 20px auto; background-color: #f8f9fa; color: #212529; } .container { background-color: #ffffff; padding: 25px; border: 1px solid #dee2e6; border-radius: 8px; box-shadow: 0 2px 4px rgba(0,0,0,0.05); } h1 { color: #343a40; border-bottom: 1px solid #dee2e6; padding-bottom: 10px; margin-bottom: 20px; } .messages div { padding: 12px 15px; margin-bottom: 15px; border-radius: 5px; border: 1px solid transparent; font-size: 0.95em; } .messages .info { color: #004085; background-color: #cce5ff; border-color: #b8daff; } .messages .success { color: #155724; background-color: #d4edda; border-color: #c3e6cb; } .messages .error { color: #721c24; background-color: #f8d7da; border-color: #f5c6cb; } label { display: block; margin-bottom: 8px; font-weight: 600; color: #495057; } input[type="file"] { display: block; margin-bottom: 10px; padding: 8px; border: 1px solid #ced4da; border-radius: 4px; width: calc(100% - 18px); /* Adjust for padding */ } input[type="file"]::file-selector-button { margin-right: 10px; padding: 8px 12px; background-color: #6c757d; color: white; border: none; border-radius: 4px; cursor: pointer; transition: background-color 0.2s ease-in-out; } input[type="file"]::file-selector-button:hover { background-color: #5a6268; } .form-group { margin-bottom: 20px; } input[type="submit"] { padding: 10px 20px; background-color: #28a745; color: white; border: none; border-radius: 5px; cursor: pointer; font-size: 1em; transition: background-color 0.2s ease-in-out; } input[type="submit"]:hover { background-color: #218838; } .info-text { font-size: 0.9em; color: #6c757d; margin-top: 15px; } </style> </head> <body> <div class="container"> <h1>Upload Multiple Files</h1>  <div class="messages"> <?php foreach ($uploadMessages as $msg): ?> <div class="info"><?php echo htmlspecialchars($msg); ?></div> <?php endforeach; ?> <?php foreach ($successMessages as $msg): ?> <div class="success"><?php echo htmlspecialchars($msg); ?></div> <?php endforeach; ?> <?php foreach ($errorMessages as $msg): ?> <div class="error"><?php echo htmlspecialchars($msg); ?></div> <?php endforeach; ?> </div>   <?php if (!is_dir($uploadDirectory) || is_writable($uploadDirectory)): ?> <form action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]); ?>" method="post" enctype="multipart/form-data">  <input type="hidden" name="MAX_FILE_SIZE" value="<?php echo $maxFileSize; ?>" /> <div class="form-group"> <label for="filesToUpload">Select files to upload:</label>  <input type="file" name="filesToUpload[]" id="filesToUpload" multiple required> </div> <div> <input type="submit" value="Upload Files" name="submit"> </div> </form> <div class="info-text"> <p>Max total upload size is limited by server configuration (e.g., `post_max_size` in php.ini).</p> <p>Individual file size limit: <?php echo formatBytes($maxFileSize); ?>.</p> <?php if (!empty($allowedMimeTypes)): ?> <p>Allowed file types: <?php echo htmlspecialchars(implode(', ', $allowedMimeTypes)); ?></p> <?php endif; ?> <p>Files will be saved to the '' directory on the server.</p> <p>Duplicate filenames will be automatically renamed (e.g., file_1.txt, file_2.txt).</p> </div> <?php else: ?> <p>File uploads are disabled due to directory permission issues mentioned above.</p> <?php endif; ?> </div>  </body> </html> ``` **Explanation:** 1. **`upload.php`:** This single file contains both the HTML form and the PHP logic to handle the uploads. 2. **Configuration:** * `$uploadDirectory`: Sets the target folder (`uploads/`). **Crucially, you MUST create this directory on your server and ensure the web server process (like `www-data`, `apache`, `nginx`) has write permissions to it.** The script now attempts to create it if it doesn't exist, but permissions might still prevent this. * `$maxFileSize`: Sets the maximum size for *each individual file*. Note that the total size of all uploaded files is also limited by PHP's `post_max_size` and `upload_max_filesize` settings in `php.ini`. * `$allowedMimeTypes`: An optional array to restrict uploads to specific file types (e.g., images, PDFs). Leave empty (`[]`) to allow any file type. It uses `finfo` for more reliable MIME type detection than relying solely on the browser-sent type. 3. **Directory Check:** The script checks if the upload directory exists and is writable *before* processing uploads. It also attempts to create the directory if it's missing. 4. **HTML Form:** * `method="post"`: Required for sending file data. * `enctype="multipart/form-data"`: Essential for file uploads. * ``: * `name="filesToUpload[]"`: The `[]` tells PHP to treat uploads with this name as an array, allowing multiple files. * `multiple`: HTML attribute enabling users to select multiple files in the file dialog. * `required`: Makes file selection mandatory on the client-side (basic validation). * `MAX_FILE_SIZE`: A hidden input hint for the browser about the maximum file size (though server-side validation is still necessary). 5. **PHP Upload Handling (`if ($_SERVER['REQUEST_METHOD'] === 'POST' ...)`):** * Checks if the form was submitted via POST and if files were sent. * Checks for initial directory errors. * **Normalization:** It restructures the `$_FILES['filesToUpload']` array into a more convenient `$files` array, making iteration easier whether single or multiple files are uploaded. * **Iteration:** Loops through each uploaded file in the `$files` array. * **Error Checking:** Checks `$file['error']` for any upload errors (e.g., file too large based on `php.ini`, partial upload). * **Security:** * `basename()`: Prevents directory traversal attacks using the original filename. * Filename Sanitization: Removes potentially problematic characters from the filename. * Duplicate Handling: Checks if a file with the same name exists and appends a counter (`_1`, `_2`, etc.) to avoid overwriting. * **Validation:** Checks file size against `$maxFileSize` and optionally checks the MIME type against `$allowedMimeTypes`. * **`move_uploaded_file()`:** If all checks pass, this function securely moves the file from PHP's temporary directory to the final `$targetFilePath`. 6. **Feedback:** Uses arrays (`$errorMessages`, `$successMessages`, `$uploadMessages`) to collect status messages during the process and displays them neatly formatted in the HTML. 7. **Helper Functions:** * `getUploadErrorMessage()`: Converts PHP's `UPLOAD_ERR_*` constants into user-friendly messages. * `formatBytes()`: Displays file sizes in a readable format (KB, MB). **Before Running:** 1. Save the code as `upload.php`. 2. **Create the `uploads` directory** in the same location as `upload.php`. 3. **Set Permissions:** Make sure your web server (e.g., Apache, Nginx running as `www-data` or similar) has **write permissions** on the `uploads` directory. You might need to use `chmod` or `chown` on a Linux/macOS server (e.g., `chmod 755 uploads` or `chmod 775 uploads` and `chown www-data:www-data uploads`). Consult your hosting provider or server documentation if unsure. 4. Access `upload.php` through your web browser.