PHP ftp file upload from form

Question

$host = 'XXXXXXXXXXX'
$usr = 'XXXXXXXXXXX';
$pwd = 'XXXXXXXXXXX';
$destDir = $_POST['filetype'];
$conn_id=ftp_connect($host);
$success = ftp_login($conn_id,$usr,$pwd);
$rightName = basename($_FILES['uploadfile']['name']);
ftp_pasv($conn_id, true);
if($success)
{ 
    ftp_put($conn_id,$destDir.'/'.$rightName,$_FILES['uploadfile']['tmp_name'],FTP_BINARY) or die('Cannot ftp');
    ftp_close($conn_id);
    echo ' Upload Successful';
}

The form is here

<form enctype="multipart/form-data" action="upload.php" method="POST">
    <input name="filetype" id="filetype1" /><br />
    <input name="uploadfile" type="file" /><br />
<input type="submit" value="Upload File" />

I have tried multiple options. 'ftp_put' from php's tmp upload location to a working directory and then to a destination directory and 'ftp_put' directly from temporary upload directory of PHP to the desired directory but FTP for some reason does not seem to work at all. It just simply dies. A normal upload using 'move_uploaded_files()' works perfectly. In some of the forums it is mentioned that for ftp to work I can't have 'file' input type and just have a plain text box. I don't understand why that needs to be the case or even if it true. Why is the above code not working? I have checked the permissions on the destination folder and it should not be the issue.

Update

Sorry, the trouble was due to a documentation issue. FTP root mentioned in the documentation was incorrect and the FTP root used in the code was different from the documented FTP root and hence the trouble.

My guess is that your FTP user should have permissions to the folder. By default, the PHP code is able to do this because of write permissions given to www-data. So FTP is a nother story altogether - at least that's what I've noticed on a common Linux server. Maybe I'm wrong. — itsols
But chmoding the destination directory to 777 should overcome this right? Or no? — Sai
chmod destination with 777? That's the craziest thing you should ever try. Then anyone/anything will just be able to put 'anything' on your server. Rather, you should give the write permissions for the www-data user. Also check if your host has any restrictions on this. Certain hosts disable certain functions. — itsols

Gerhard Gerhard · Accepted Answer · 2013-07-16T15:22:07

Moving around files in PHP ia a tricky thing as there are a couple of things playing together.

The destination directory must be writeable by the server process.
PHP has security features. One of them is called safe_mode. Safe mode checks (beside other things) the UID and GID (user id and group id) of files and restricts for example what files are allowed to include. As well as it avoids creating them in directories not owned by the script UID / GID. Usually the user you upload with is not the user the webserver is running in. So when you create for example a directory, it is created with the webservers UID/GID and creating files in it is not possible from a PHP script that has a different UID/GID.

PHP ftp file upload from form

1 Answers