限制 PHP 表单上传中的文件类型和大小

Hi all I have found some really good code over on http://apptools.com thats helped me create a form that allows users to enter there details upload a file and it then emails it to me automatically which is great. I just wondered if you knew how I could restrict the file types to doc, pdf, psd, ai, jpg, bmp and maybe a few more in the future and also restrict it to 5mb in size. The code I have is below:

<?php
if(!isset($_POST['Submit'])){
echo "error; you need to submit the form!";
}
else {


$to="my@email.com";
$subject="Subject header";
$enquiry = $_POST['message2'];
$company = $_POST['company2'];
$tel = $_POST['tel2'];
$client = $_POST['fromname'];
$clientemail = $_POST['fromemail'];
$from = stripslashes($_POST['fromname'])."<".stripslashes($_POST['fromemail']).">";
$mime_boundary="==Multipart_Boundary_x".md5(mt_rand())."x";
$headers = "From: $from
" .
"MIME-Version: 1.0
" .
"Content-Type: multipart/mixed;
" .
" boundary="{$mime_boundary}"";

$message="Email from $fromname on  Contact form.

 Details are as follows:
 Name:
$client 
 Company: $company 
 Email: $clientemail 
 Telephone: $tel 
 Message: 
$enquiry 
".
"
 Please contact them within 48 hours.";

$message = "This is a multi-part message in MIME format.

" .
"--{$mime_boundary}
" .
"Content-Type: text/plain; charset="iso-8859-1"
" .
"Content-Transfer-Encoding: 7bit

" .
$message . "

";
foreach($_FILES as $userfile){
$tmp_name = $userfile['tmp_name'];
$type = $userfile['type'];
$name = $userfile['name'];
$size = $userfile['size'];


if (file_exists($tmp_name)){


if(is_uploaded_file($tmp_name)){
$file = fopen($tmp_name,'rb');
$data = fread($file,filesize($tmp_name));
fclose($file);
$data = chunk_split(base64_encode($data));
}

$message .= "--{$mime_boundary}
" .
"Content-Type: {$type};
" .
" name="{$name}"
" .
"Content-Disposition: attachment;
" .
" filename="{$fileatt_name}"
" .
"Content-Transfer-Encoding: base64

" .
$data . "

";
}
}
$message.="--{$mime_boundary}--
";
if (@mail($to, $subject, $message, $headers))
echo "Message Sent";
else
echo "Failed to send";
}  ?>

任何帮助都会很棒.

推荐答案

可以在php.ini中限制上传大小(here)，你可以检查上传文件的扩展名来验证它是一个可接受的格式(未经测试的代码):

$okExtensions = array('jpg', 'png');
$fileName = 'test.doc';

$fileParts = explode('.', $fileName);

if( in_array( strtolower( end($fileParts) ), $okExtensions) )
{
  // proceed
}