Mirificam Press

SET SQL_MODE="NO_AUTO_VALUE_ON_ZERO";

CREATE TABLE IF NOT EXISTS `Files` (
  `ID` int(25) NOT NULL auto_increment,
  `Title` varchar(250) NOT NULL default '',
  `File_Name` varchar(250) NOT NULL default '',
  `File_Type` varchar(15) NOT NULL default '',
  `File_Size` varchar(45) NOT NULL default '',
  `File_Content` longblob NOT NULL,
  `File_Extension` varchar(10) NOT NULL default '',
  PRIMARY KEY  (`ID`),
) ENGINE=InnoDB DEFAULT CHARSET=latin1 AUTO_INCREMENT=1;

<form action="<?=$PHP_SELF;?>" method="POST" enctype="multipart/form-data" name="upload_form" id="upload_form">
    <label>Title:</label><input name="title" type="text" id="title" value="<?=htmlentities(stripslashes($_POST['title']));?>" size="35">
    <label>File:</label<input type="file" name="file">   
    <input name="action" type="hidden" id="action" value="add_document">
</form>

// Connect to the database
// replace "user_name" and "password" with your real login info

$dbh = mysql_connect("localhost","user_name","password") or die("There was a problem with the database connection.");
    $dbs = mysql_select_db("MyDatabase", $dbh) or die("There was a problem selecting the categories.");

// Set up a list of acceptable file extensions.
// This keeps out malicious files

$acceptable_extensions[0] = "pdf";
$acceptable_extensions[1] = "jpg";
$acceptable_extensions[2] = "gif";
$acceptable_extensions[3] = "doc";
$acceptable_extensions[4] = "ppt";
$acceptable_extensions[5] = "xls";
$acceptable_extensions[6] = "xsl";
$acceptable_extensions[7] = "PDF";
$acceptable_extensions[8] = "JPG";
$acceptable_extensions[9] = "GIF";
$acceptable_extensions[10] = "DOC";
$acceptable_extensions[11] = "PPT";
$acceptable_extensions[12] = "XLS";
$acceptable_extensions[13] = "XSL";
$acceptable_extensions[14] = "txt";
$acceptable_extensions[15] = "TXT";
$acceptable_extensions[16] = "csv";
$acceptable_extensions[17] = "CSV";
$acceptable_extensions[18] = "docx";
$acceptable_extensions[19] = "DOCX";

// Check the uploaded file to make sure it's a valid file

$validated = 1;

if($_FILES && $_FILES['file']['name']){
           
    //make sure the file has a valid file extension
   
    $file_info = pathinfo($_FILES['file']['name']);
    $acceptable_ext = 0;
               
    for($x = 0; $x < count($acceptable_extensions); $x++){
                   
        if($file_info['extension'] == $acceptable_extensions[$x]){
            $acceptable_ext = 1;
                       
        }
    }
               
    if(!$acceptable_ext){
        $validated = 0;
    }  
}else{
    $validated = 0;
}

//Now that we're sure we have a valid file,
//we'll add it into the database

if($validated){

    // Get important information about the file and put it into variables

    $fileName = $_FILES['file']['name'];
    $tmpName  = $_FILES['file']['tmp_name'];
    $fileSize = $_FILES['file']['size'];
    $fileType = $_FILES['file']['type'];

    // Slurp the content of the file into a variable
                   
    $fp = fopen($tmpName, 'r');
    $content = fread($fp, filesize($tmpName));
    $content = addslashes($content);
    fclose($fp);

    if(!get_magic_quotes_gpc()){
        $fileName = addslashes($fileName);
     }
                   
    $file_info = pathinfo($_FILES['file']['name']);

    $sql = "INSERT INTO Files SET
                Title = "".htmlentities(stripslashes($_POST['title']))."",
                File_Name = '".$fileName."',
                File_Type = '".$fileType."',
                File_Size = '".$fileSize."',
                File_Content = '".$content."',
                File_Extension = '".$file_info['extension']."'";
               
               
    $result = mysql_query($sql);
           
    // If the query was successful, give success message

    if(!$result){
        echo "Could not add this file.";
         exit;
    }
    else{
        echo  "New file successfully added.";
    }

}else{
    echo "Invalid file.";
    exit;
}

// We'll start out again by connecting to the database
// replace "user_name" and "password" with your real login info

$dbh = mysql_connect("localhost","user_name","password") or die("There was a problem with the database connection.");
    $dbs = mysql_select_db("MyDatabase", $dbh) or die("There was a problem selecting the categories.");

// Now, We'll check to make sure our $_GET variable is a number

if(!is_numeric($_GET['id']){
    echo "Invalid file chosen.";
    exit;
}

// Next, we'll run a query on the database to get the file out

$sql = "SELECT * FROM Files
            WHERE Files.ID = ".$_GET['id'];
           
$result = mysql_query($sql);

// If the query was invalid or failed to return a result, an error is thrown

if(!$result || !mysql_num_rows($result)){
    echo "Invalid file chosen.";
    exit;
}

// Finally, we will send the file to the browser

$curr_file = mysql_fetch_assoc($result);

$size = $curr_file['File_Size'];
$type = $curr_file['File_Type'];
$name = $curr_file['File_Name'];
$content = $curr_file['File_Content'];

header("Content-length: ".$size."");
header("Content-type: ".$type."");
header('Content-Disposition: attachment; filename="'.$name.'"');
echo $content;

// That's it. We're finished.