Error Messages Explained

Since PHP 4.2.0, PHP returns an appropriate error code along with the file array. The error code can be found in the error segment of the file array that is created during the file upload by PHP. In other words, the error might be found in $_FILES['userfile']['error'].

UPLOAD_ERR_OK: Value: 0; There is no error, the file uploaded with success.
UPLOAD_ERR_INI_SIZE: Value: 1; The uploaded file exceeds the upload_max_filesize directive in php.ini.
UPLOAD_ERR_FORM_SIZE: Value: 2; The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form.
UPLOAD_ERR_PARTIAL: Value: 3; The uploaded file was only partially uploaded.
UPLOAD_ERR_NO_FILE: Value: 4; No file was uploaded.
UPLOAD_ERR_NO_TMP_DIR: Value: 6; Missing a temporary folder. Introduced in PHP 4.3.10 and PHP 5.0.3.
UPLOAD_ERR_CANT_WRITE: Value: 7; Failed to write file to disk. Introduced in PHP 5.1.0.
UPLOAD_ERR_EXTENSION: Value: 8; File upload stopped by extension. Introduced in PHP 5.2.0.

Note:

These became PHP constants in PHP 4.3.0.

Code Examples / Notes » features.file_upload.errors

or perhaps this: <?php switch ($filearray["error"]) { case UPLOAD_ERR_INI_SIZE: throw new Exception("The uploaded file exceeds the upload_max_filesize directive (".ini_get("upload_max_filesize").") in php.ini."); break; case UPLOAD_ERR_FORM_SIZE: throw new Exception("The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form."); break; case UPLOAD_ERR_PARTIAL: throw new Exception("The uploaded file was only partially uploaded."); break; case UPLOAD_ERR_NO_FILE: throw new Exception("No file was uploaded."); break; case UPLOAD_ERR_NO_TMP_DIR: throw new Exception("Missing a temporary folder."); default: throw new Exception("An unknown file upload error occured"); } ?>

In response to Hans: The problem with your switch statement is that it never allows for no errors, i.e. the UPLOAD_ERR_OK val. So to still allow room for further errors, yet notice a no-error case, this needs to be addressed: <?php switch ($filearray["error"]) { case UPLOAD_ERR_OK: break; case UPLOAD_ERR_INI_SIZE: throw new Exception("The uploaded file exceeds the upload_max_filesize directive (".ini_get("upload_max_filesize").") in php.ini."); break; case UPLOAD_ERR_FORM_SIZE: throw new Exception("The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form."); break; case UPLOAD_ERR_PARTIAL: throw new Exception("The uploaded file was only partially uploaded."); break; case UPLOAD_ERR_NO_FILE: throw new Exception("No file was uploaded."); break; case UPLOAD_ERR_NO_TMP_DIR: throw new Exception("Missing a temporary folder."); break; case UPLOAD_ERR_CANT_WRITE: throw new Exception("Failed to write file to disk"); break; default: throw new Exception("Unknown File Error"); } ?>

In reply to "svenr at selfhtml dot org" Since uploaded files are sent in the HTTP request body following the MAX_UPLOAD_FILE_SIZE file (that's why you need to put it before the file field in HTML), PHP can stop receiving the rest of the HTTP request body when the Content-Length header of that particular part of the request is more than the value of the MAX_FILE_SIZE field. Therefore, using the field renders a convenience, not a security fix, since the server can stop receiving the request body and start responding right after PHP has decided that the content-length is more (bytes) than allowed. This means that the client doesn't have to upload the entire body of the http-request, just to see an error appear. You can test this by using the field on a local server and for instance upload a 700MB iso or avi file or so. You will see that the server is quite quick in responding to say that the file is too large, even though the file hasn't been uploaded completely. Conclusively, MAX_FILE_SIZE isn't that useless after all (as upload_max_filesize is a PHP_INI_PERDIR setting) but you should be cautious to only use it as a convenience thing for the client, not as a security thing.

I've been playing around with the file size limits and with respect to the post_max_size setting, there appears to be a hard limit of 2047M. Any number that you specify above that results in a failed upload without any informative error describing what went wrong. This happens regardless of how small the file you're uploading may be. On error, my page attempts to output the name of the original file. But what I discovered is that this original file name, which I maintained in a local variable, actually gets corrupted. Even my attempt to output the error code in $_FILES['uploadedfiles']['error'] returns an empty string/value. Hopefully, this tidbit will save someone else some grief.

Clarification on the MAX_FILE_SIZE hidden form field and the UPLOAD_ERR_FORM_SIZE error code: PHP has the somewhat strange feature of checking multiple "maximum file sizes". The two widely known limits are the php.ini settings "post_max_size" and "upload_max_size", which in combination impose a hard limit on the maximum amount of data that can be received. In addition to this PHP somehow got implemented a soft limit feature. It checks the existance of a form field names "max_file_size" (upper case is also OK), which should contain an integer with the maximum number of bytes allowed. If the uploaded file is bigger than the integer in this field, PHP disallows this upload and presents an error code in the $_FILES-Array. The PHP documentation also makes (or made - see bug #40387 - http://bugs.php.net/bug.php?id=40387) vague references to "allows browsers to check the file size before uploading". This, however, is not true and has never been. Up til today there has never been a RFC proposing the usage of such named form field, nor has there been a browser actually checking its existance or content, or preventing anything. The PHP documentation implies that a browser may alert the user that his upload is too big - this is simply wrong. Please note that using this PHP feature is not a good idea. A form field can easily be changed by the client. If you have to check the size of a file, do it conventionally within your script, using a script-defined integer, not an arbitrary number you got from the HTTP client (which always must be mistrusted from a security standpoint).

1. And what about multiple file upload ? - If there is an UPLOAD_ERR_INI_SIZE error with multiple files - we can`t detect it normaly ? ...because that we have an array, but this error returns null and can`t use foreach. So, by having a multiple upload, we can`t normaly inform user about that.. we can just detect, that sizeof($_FILES["file"]["error"]) == 0 , but we can`t actualy return an error code. The max_file_size also is not an exit, becouse it refers on each file seperatly, but upload_max_filesize directive in php.ini refers to all files together. So, for example, if upload_max_filesize=8Mb , max_file_size = 7Mb and one of my files is 6.5Mb and other is 5Mb, it exeeds the upload_max_filesize - cant return an error, becouse we don`t know where to get that error. Unfortunately we cannot get the file sizes on client side, even AJAX normaly can`t do that. 2. If in file field we paste something, like, D:\whatever , then there also isn`t an error to return in spite of that no such file at all.

Error Messages Explained

Code Examples / Notes » features.file_upload.errors

Change Language