PHP 簡易圖片上傳類：限制類型與大小、上傳後即時顯示

類別 upload

class upload {
    var $upload_name;
    var $upload_tmp_address;
    var $upload_server_name;
    var $upload_filetype;
    var $file_type = array("image/gif", "image/pjpeg");
    var $file_server_address;
    var $image_w = 900;   // 顯示寬度
    var $image_h = 350;   // 顯示高度
    var $upload_file_size;
    var $upload_must_size = 50000; // 允許大小（位元組）

    function upload_file() {
        $this->upload_name = $_FILES["file"]["name"];
        $this->upload_filetype = $_FILES["file"]["type"];
        $this->upload_server_name = date("Y_m_d_H_i_s") . $this->upload_name;
        $this->upload_tmp_address = $_FILES["file"]["tmp_name"];
        $this->upload_file_size = $_FILES["file"]["size"];

        if(in_array($this->upload_filetype, $this->file_type)) {
            if($this->upload_file_size < $this->upload_must_size) {
                echo "上傳成功，謝謝支持";
                $this->file_server_address = "d:www.bkjia.comupload/" . $this->upload_server_name;
                move_uploaded_file($this->upload_tmp_address, $this->file_server_address);
                echo "";
            } else {
                echo "檔案容量太大";
            }
        } else {
            echo "不支援此檔案類型，請重新選擇";
        }
    }
}

前端表單

<form id="form1" name="upload" enctype="multipart/form-data" method="post" action="upload.php">
    <input type="hidden" name="MAX_FILE_SIZE" />
    <input type="file" name="file" />
    <input type="submit" name="submit" value="提交" />
</form>

呼叫頁面 upload.php

include('uploadimg.class.php');
$dd = new upload();
$dd->upload_file();

改進建議：
1. 檔案路徑應使用相對路徑或設定常數，避免硬編碼 d:www.bkjia.comupload/。
2. 檔名加入隨機數或雜湊避免衝突。
3. 使用 getimagesize() 二次驗證圖片真偽。
4. 輸出 HTML 時對屬性值加雙引號，防止 XSS。