<?php
////////////////////////////////////
// © 2009 Wouter De Schuyter
// info[@]paradox-productions[.]net
// http://paradox-productions.net/
// UPLOAD SCRIPT V1.0
////////////////////////////////////
include "index2.html";
require_once "config.inc";
require_once "database.php";
/* NOTE
*******
!! DON'T FORGET TO CHMOD THE UPLOAD FOLDER TO 0777

THIS WORK IS LICENSED UNDER A CREATIVE COMMONS ATTRIBUTION 3.0 LICENSE.
THIS MEANS YOU MAY USE IT FOR ANY PURPOSE, AND MAKE ANY CHANGES YOU LIKE.
ALL I ASK IS TO LEAVE THE ORIGINAL COPYRIGHT AT TOP OF THE SCRIPT.
VIEW LICENSE ONLINE: http://creativecommons.org/licenses/by/3.0/
*/

// OPEN DE BD CONN
    if (!$dbLink = openDB())
    {
        exit;
    }





/* CONFIG
*********/

$extensions = array('php' , 'sh'); // DENYD EXTENSIONS
$tfolder = "uploads/"; // UPLOADS FOLDER WITH "/" AT THE END (JUST DIR)!
$scriptloc = "http://upload.mattie-systems.nl/"; // SCRIPT LOCATION WITH "/" AT THE END (FULL URL)!
$maxfsize = 75; // MAXIMUM FILESIZE (IN MEGABYTES)

    // CHECK IF THE FORM HAS BEEN SUBMITTED
    if($_SERVER['REQUEST_METHOD'] == "POST") {
        $fname = $_FILES['filen']['name']; // FILE NAME FOR EXTENSION CHECK
        $fext = strtolower(end(explode('.', $fname))); // GET EXTENSION
        $ftemp = $_FILES['filen']['tmp_name']; // TEMP NAME
       // $newname = md5(rand(rand(1, 9999), rand(1, 9999))) . "." . $fext; // RANDOM NUMBER BETWEEN 2 RANDOM NUMBERS BETWEEN 1 AND 9999 AND MD5 ENCODED = RANDOM FILE NAME
       $naam_en_ext_klein = strtolower($fname);
    $naam_met_dingen = str_replace(" ", "_", $naam_en_ext_klein);
    $newname = rand(1, 99999) . "-" . $naam_met_dingen ;
    $target = $tfolder . $newname; // LOCATION FILE

        // CHECK IF THERE IS A FILE SELECTED
        if(!empty($fname)) {
            // CHECK THE EXTENSION
            foreach($extensions as $check) {
                if($check == $fext) {
                    $extensioncheck = true;
                }
            }
            // IF EXTENSION IS ALLOWED
            if($extensioncheck != true) {
                // IF FILE IS TOO BIG
                if(filesize($ftemp) > $maxfsize * (10240*10240)) {
                    echo "<center>Your file is too big. The maximum filesize is <b>" . $maxfsize . "</b>MB.</center>";
                }
                // IF FILESIZE IS ALLOWED
                else {
                    // CHECK FOR FALSE FILES EG image.php.gif (SOME SERVERS JUST TAKE .php AND THIS IS A POSSIBLE RISK)
                    if(!strstr(strtolower($fname), "php")) {
                        $upload = move_uploaded_file($ftemp, $target); // MOVE TO FOLDER WITH NEW RANDOM NAME
                        // TRY TO MOVE THE FILE TO THE DIRECTORY
                        if($upload) {
                            echo "<center>Your file has succesfully been uploaded.<br /><br>Download link: <a href=\" " . $scriptloc . $target . " \">" . $scriptloc . $target . "</a><br />Note: spaces are replaced by a \"_\"</center>";
                            $succes = true;



                                        $insert = "INSERT INTO `$table` (`ID`) VALUES (1337)";
    $result = mysql_query($insert);





                        }
                        // UPLOAD ERROR
                        else {
                            echo "<center>upload error</center>";
                        }
                    }
                    // WHEN THE FILE NAME CONTAINS php
                    else {
                        echo "<center>Your file cannot contain the string 'php'!</center>";
                    }
                } // CLOSE FILESIZE ALLOWED ELSE FUNCTION
            } // CLOSE EXTENSION ALLOWED IF FUNCTION
            // EXTENSION ERROR
            else {
                echo "<center>This extension is not allowed.</center>";
            }
        } // CLOSE IF FILE SELECTED IF FUNCTION
        // NO FILE SELECTED ERROR
        else {
            echo "<center>Please select a file to upload.</center>";
        }

    } // CLOSE IF SUBMIT IS PRESSED FUNCTION

    // IF FILE WAS UPLOADED SUCESSFULLY HIDE FORM
    if($succes !== true) {
        echo '<center><form action="" method="post" enctype="multipart/form-data"></center>';
        echo '<center>File: <input type="file" name="filen" /> <br><br> <input type="submit" name="subform" value="Upload File!" /></center>';
        echo '</form>';


    }

    //close db link
        closeDB($dbLink);
?>