PHP文件上传源码分析(RFC1867)

<form enctype="multipart/form-data" action="upload.php" method=post>
选择文件:
<input name="userfile" type="file">
文件描述:
<input name="description" type="text">
<input type="submit" value="上传">
</form>

<form enctype="multipart/form-data" action="upload.php" method=post>
<input type="hidden" value="5000" name="MAX_FILE_SIZE"> <!--文件大小-->
选择文件:
<input name="userfile" type="file">
文件描述:
<input name="description" type="text">
<input type="submit" value="上传">
</form>

//请求头
POST /upload.php HTTP/1.0rn
...
Host: www.laruence.comrn
...
Content-length: xxxxxrn
...
Content-type: multipart/form-data, boundary=--------------7d51863950254rn
...rnrn
//开始POST数据内容
---------------7d51863950254
content-disposition: form-data; name="description"
laruence的个人介绍
---------------7d51863950254
content-disposition: form-data; name="userfile"; filename="laruence.txt"
Content-Type: text/plain
... laruence.txt 的内容...
---------------7d51863950254

if ((cd = php_mime_get_hdr_value(header, "Content-Disposition"))) {
 char *pair=NULL;
 int end=0;

 while (isspace(*cd)) {
  ++cd;
 }

 while (*cd && (pair = php_ap_getword(&cd, ';')))
 {
  char *key=NULL, *word = pair;

  while (isspace(*cd)) {
   ++cd;
  }

  if (strchr(pair, '=')) {
   key = php_ap_getword(&pair, '=');

   if (!strcasecmp(key, "name")) {
    //获取name字段
    if (param) {
     efree(param);
    }
    param = php_ap_getword_conf(&pair TSRMLS_CC);
   } else if (!strcasecmp(key, "filename")) {
    //获取filename字段
    if (filename) {
     efree(filename);
    }
    filename = php_ap_getword_conf(&pair TSRMLS_CC);
   }
  }
  if (key) {
   efree(key);
  }
  efree(word);
 }

 /* Normal form variable, safe to read all data into memory */
if (!filename && param) {
 unsigned int value_len;
 char *value = multipart_buffer_read_body(mbuff, &value_len TSRMLS_CC);
 unsigned int new_val_len; /* Dummy variable */
 ......

 if (!strcasecmp(param, "MAX_FILE_SIZE")) {
                  max_file_size = atol(value);
    }

 efree(param);
 efree(value);
 continue;
}

if (PG(upload_max_filesize) > 0 && total_bytes > PG(upload_max_filesize)) {
 cancel_upload = UPLOAD_ERROR_A;
} else if (max_file_size && (total_bytes > max_file_size)) {
#if DEBUG_FILE_UPLOAD
 sapi_module.sapi_error(E_NOTICE,
  "MAX_FILE_SIZE of %ld bytes exceeded - file [%s=%s] not saved",
   max_file_size, param, filename);
#endif
 cancel_upload = UPLOAD_ERROR_B;
}

 if (!skip_upload) {
 /* Handle file */
 fd = php_open_temporary_fd_ex(PG(upload_tmp_dir),
    "php", &temp_filename, 1 TSRMLS_CC);
 if (fd==-1) {
  sapi_module.sapi_error(E_WARNING,
    "File upload error - unable to create a temporary file");
  cancel_upload = UPLOAD_ERROR_E;
 }
}

else if (blen > 0) {
 wlen = write(fd, buff, blen); //写入临时文件.
 if (wlen == -1) {
 /* write failed */
#if DEBUG_FILE_UPLOAD
 sapi_module.sapi_error(E_NOTICE, "write() failed - %s", strerror(errno));
#endif
 cancel_upload = UPLOAD_ERROR_F;
 }
}
....

zend_hash_add(SG(rfc1867_uploaded_files), temp_filename,
 strlen(temp_filename) + 1, &temp_filename, sizeof(char *), NULL);

$_FILES['userfile'] //name="userfile"

$_FILES['tmp_name'] //无名上传

--
-- 表的结构 `count_voting`
--

DROP TABLE IF EXISTS `count_voting`;
CREATE TABLE IF NOT EXISTS `count_voting` (
  `SelectName` varchar(40) NOT NULL,
  `LabelName` varchar(40) NOT NULL,
  `CountVotes` bigint(20) unsigned NOT NULL,
  UNIQUE KEY `SelectName` (`SelectName`),
  KEY `CountVotes` (`CountVotes`),
  KEY `CountVotes_2` (`CountVotes`),
  KEY `CountVotes_3` (`CountVotes`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COMMENT='投票统计表';

-- --------------------------------------------------------

--
-- 表的结构 `ip_votes`
--

DROP TABLE IF EXISTS `ip_votes`;
CREATE TABLE IF NOT EXISTS `ip_votes` (
  `ID` bigint(20) unsigned NOT NULL auto_increment COMMENT '投票人序号：自增',
  `IP` varchar(15) NOT NULL COMMENT '投票人IP',
  `Location` varchar(40) NOT NULL COMMENT '投票人位置',
  `VoteTime` datetime NOT NULL,
  `SelectName` varchar(40) NOT NULL,
  PRIMARY KEY  (`ID`),
  KEY `ID` (`ID`),
  KEY `SelectName` (`SelectName`)
) ENGINE=InnoDB  DEFAULT CHARSET=utf8 AUTO_INCREMENT=4 ;

--
-- 触发器 `ip_votes`
--
DROP TRIGGER IF EXISTS `vote_count_after_insert_tr`;
DELIMITER //
CREATE TRIGGER `vote_count_after_insert_tr` AFTER INSERT ON `ip_votes`
 FOR EACH ROW UPDATE count_voting SET CountVotes = CountVotes + 1 WHERE SelectName = NEW.SelectName
//
DELIMITER ;

-- --------------------------------------------------------

--
-- 表的结构 `user`
--

DROP TABLE IF EXISTS `user`;
CREATE TABLE IF NOT EXISTS `user` (
  `name` varchar(10) NOT NULL COMMENT '管理员用户名',
  `passwd` char(32) NOT NULL COMMENT '登录密码MD5值'
) ENGINE=InnoDB DEFAULT CHARSET=utf8 COMMENT='用户表';

--
-- 转存表中的数据 `user`
--

INSERT INTO `user` (`name`, `passwd`) VALUES
('ttxi', '700469ca1555900b18c641bf7b0a1fa1'),
('jitttanwa', 'adac5659956d68bcbc6f40aa5cd00d5c');

--
-- 限制导出的表
--

--
-- 限制表 `ip_votes`
--
ALTER TABLE `ip_votes`
  ADD CONSTRAINT `ip_votes_ibfk_1` FOREIGN KEY (`SelectName`) REFERENCES `count_voting` (`SelectName`) ON DELETE CASCADE ON UPDATE CASCADE;

/**
 * 操作数据库
 * 封装PDO，使其方便自己的操作
 */
class OperatorDB
{
    //连接数据库的基本信息
    private $dbms='mysql';       //数据库类型,对于开发者来说，使用不同的数据库，只要改这个.
    private $host='localhost';       //数据库主机名
    private $dbName='voting';     //使用的数据库
    private $user='voting';       //数据库连接用户名
    private $passwd='voting';     //对应的密码
    private $pdo=null;

    public function  __construct()
    {
        //dl("php_pdo.dll");
        //dl("php_pdo_mysql.dll");
        $this->dsn="$this->dbms:host=$this->host;dbname=$this->dbName";
        try
        {
            $this->conn=new PDO($this->dsn,$this->user,$this->passwd);//初始化一个PDO对象，就是创建了数据库连接对象$db
        }
        catch(PDOException $e)
        {
            die("<br/>数据库连接失败(creater PDO Error！): ".$e->getMessage()."<br/>");
        }
    }
    public function __destruct()
    {
        $this->pdo = null;
    }
    public function exec($sql)
    {
    }
    public function query($sql)
    {
    }
}

<?php
require_once 'OperatorDB.php';
class OperatorVotingDB
{
    private $odb;

    public function  __construct()
    {
        $this->odb = new OperatorDB();
    }
    public function __destruct()
    {
        $this->odb = null;
    }

    /**
     * 清空Voting数据中的所有表
     *
     * 调用数据库操作类，执行clear数据库的操作
     */
    public function clearTables()
    {
        $sqls = array("TRUNCATE ip_votes;","TRUNCATE count_voting;");
        $this->odb->exec($sqls[0]);
        $this->odb->exec($sqls[1]);
    }

    /**
     * 重置count_voting表中的CountValues字段为0
     *
     */
    public function resetCountValues()
    {
        $sql = "UPDATE count_voting SET CountVotes = 0;";
        $this->odb->exec($sql);
    }

    /**
     * 投票
     * 将信息写入ip_votes表
     * @param type $ip
     * @param type $loc
     * @param type $time
     * @param type $name
     */
    public function vote($ip,$loc,$name)
    {
        $sql = "INSERT INTO ip_votes VALUES (NULL, '$ip', '$loc', NOW(), '$name')";
        $subsql = "SELECT MAX(to_days(VoteTime)) FROM ip_votes WHERE IP='$ip'";
        $stm = $this->odb->query($subsql);
        if (count($row=$stm->fetchAll())==1)
        {
            $now = date("Y-m-d H:i:s");
            $subsql = "SELECT to_days('$now');";
            $stm = $this->odb->query($subsql)->fetch();
            $time = $stm[0];//使用mysql计算出的today时间
//            echo $time."<br>";
//            echo $row[0][0];
            if ($time-$row[0][0]<1)//表中最大的时间和现在的时间$time比较
            {
                echo "投票失败，相同ip需要隔一天才能投票";
                return;
            }
        }
//        echo $sql;
        echo "投票成功!";
        $this->odb->exec($sql);
    }

    /**
     * 添加SelectName字段的行
     *
     * @param string $name
     * @param string $label
     * @param int $count
     */
    public function addSelectName($name, $label, $count=0)
    {
        $sql = "INSERT INTO count_voting VALUES ('$name', '$label', $count);";
        $this->odb->exec($sql);
    }

    /**
     * 获取总投票情况,按票数排序的结果
     *
     * 按CountVotes字段排序，返回count_voting表
     *
     * @param int $n
     *
     */
    public function getVotesSortByCount($n=-1)
    {
        $sql = "SELECT * FROM count_voting ORDER BY CountVotes DESC LIMIT 0 , $n;";
        if (-1 == $n)
        {
            $sql = "SELECT * FROM count_voting ORDER BY CountVotes DESC;";
        }
//        echo $sql;
        return $this->odb->query($sql);
    }

    /**
     * 获取投票情况,按票数排序并按标签分组的结果
     *
     * 按CountVotes字段排序并按LabelName字段分组，返回count_voting表
     */
    public function getVotesGroupByLabel()
    {
        $sql = "SELECT * FROM count_voting ORDER BY LabelName DESC;";
//        echo $sql;
        return $this->odb->query($sql);
    }
}
?>

<?php
require_once 'Zend/Auth/Adapter/Interface.php';
class Auth implements Zend_Auth_Adapter_Interface{
    private $_useraccount;
    private $_password;
    private $_db;
    /**
     * 构造函数 设置用户名和密码 数据连接对象  
     *
     * @return void     
     */
    public function __construct($useraccount,$password,$db){  
        $this->_useraccount = $useraccount;
        $this->_password      = $password;
        $this->_db             = $db;
    }
   
    /**    
     * 进行认证 
     * @throws Zend_Auth_Adapter_Exception   
     * @return Zend_Auth_Result
     *
     */
    public function authenticate()
    {
        //默认情况下是认证失败
        $authResult = array(
            'code'     => Zend_Auth_Result::FAILURE,//详参：Zend_Auth_Result
            'identity' => '',
            'info' => array()
           );
          
           //获得登录用户信息
        $result = $this->_getAccountData();
               
        if(isset($result)&&!empty($result)) {//认证成功,则将用户信息存储到session中
            $authResult = array(
                'code'     => Zend_Auth_Result::SUCCESS,
                'identity' => $result['name'],
                'info'     => array('status'=>$result['status'])
            );
            //角色存储  个人缓存空间
            $namespace = Zend_Auth::getInstance()//单例模式
                                 -> getStorage()
                                 -> getNamespace();
            $_SESSION[$namespace]['role']     = $result['group_id'];//所属用户组
            $_SESSION[$namespace]['userInfo'] = $result;
            $_SESSION[$namespace]['userInfo']['lastLoginTime'] = $result['login_time'];
            $_SESSION[$namespace]['userInfo']['lastLoginIp']   = $result['login_ip'];          
//            $_SESSION[$namespace]['userInfo']['password']   = $result['password'];//密码是很重要的，不要写到session中
        }
       
        return new Zend_Auth_Result($authResult['code'], $authResult['identity'], $authResult['info']);
    }
    /**
     * 用户密码加密
     * @param $pwd  原始密码
     * @return string  加密后的密码字符串
     *
     */
    static public function encryptionType($pwd=null) {
        $pwd = md5($pwd);
        return $pwd;
    }
    /**
     * 获得用户数据结构
     *
     * @todo 整理密码的公共类
     */
    private function _getAccountData(){
        $resArr = array();
        $sysUserObj = Base_Dao_Factory::getObject('Admin_Models_User');
        //先登录普通会员帐号
        $data = array(
            'login_name' => $this->_useraccount,
            'login_pwd'  => $this->encryptionType($this->_password)
        );
        $result = $sysUserObj->login($data);
        //判断是否有数据,是则赋值
        if ($result) {
            if (!empty($result[0])) {
                $resArr = $result[0];
            }
        }
        return $resArr;
    }
}

form action="upload.php" id="form1" name="form1" enctype="multipart/form-data" method="post" target="uploadIframe">
<!--上传图片页面  -->
</form>
<iframe name="uploadIframe" id="uploadIframe" style="display:none"></iframe>

a.html

 <form enctype="multipart/form-data" action="a.php" target="ifram_sign" method="POST">
        <input name="submit" id="submit" value="" type="hidden">
        <label>上传文件: <input name="test_file" type="file" id="test_file" size="48"></label>
        <input type="image" value="立即上传" id="submit_btn">
 </form>

<iframe name="ifram_sign" src="" frameborder="0" height="0" width="0" marginheight="0" marginwidth="0"></iframe>

class Htpasswd {
private $file = '';
private $salt = 'AynlJ2H.74VEfI^BZElc-Vb6G0ezE9a55-Wj';
private function write($pairs = array()) {
$str = '';
foreach ($pairs as $username => $password) {
$str .= "$username:{SHA}$passwordn";
}
file_put_contents($this -> file, $str);
}
private function read() {
$pairs = array();
$fh = fopen($this -> file, 'r');
while (!feof($fh)) {
$pair_str = str_replace("n", '', fgets($fh));
$pair_array = explode(':{SHA}', $pair_str);
if (count($pair_array) == 2) {
$pairs[$pair_array[0]] = $pair_array[1];
}
}
return $pairs;
}
private function getHash($clear_password = '') {
if (!empty($clear_password)) {
return base64_encode(sha1($clear_password, true));
} else {
return false;
}
}
public function __construct($file) {
if (file_exists($file)) {
$this -> file = $file;
} else {
die($file." doesn't exist.");
return false;
}
}
public function addUser($username = '', $clear_password = '') {
if (!empty($username) && !empty($clear_password)) {
$all = $this -> read();
if (!array_key_exists($username, $all)) {
$all[$username] = $this -> getHash($clear_password);
$this -> write($all);
}
} else {
return false;
}
}
public function deleteUser($username = '') {
$all = $this -> read();
if (array_key_exists($username, $all)) {
unset($all[$username]);
$this -> write($all);
} else {
return false;
}
}
public function doesUserExist($username = '') {
$all = $this -> read();
if (array_key_exists($username, $all)) {
return true;
} else {
return false;
}
}
public function getClearPassword($username) {
return strtolower(substr(sha1($username.$this -> salt), 4, 12));
}
}