Dynamic generated file upload control doesn't post?

Question

Hai I am having a form which contains a filetype like this

  <tr><td> <input name="ufile[]" type="file" id="ufile[]" size="50" /></td></tr>

on submit i am calling a script

function addRowToTable()
    {
        var tbl = document.getElementById('uploadTab');
        var lastrow = tbl.rows.length;
        var iteration = lastrow; 
        var row = tbl.insertRow(lastrow);

        var cell2 = row.insertCell(0);
        var e2 = document.createElement('input');
        e2.type = 'file';
        e2.name = 'ufile[]';
        e2.id = 'ufile[]';
        e2.size='50';
        cell2.appendChild(e2);
    }

This script generates The tr on a button click... In my view generatedsource tool i get the "" like this

<tr><td><input size="50" id="ufile[]" name="ufile[]" type="file"></td></tr>

when i submit the form i dont get the file name for the generated file type in my view page But i get the file name foe the one that is default What may be the problem?

I posting my form to this page,

<?php
//set where you want to store files
//in this example we keep file in folder upload
//$HTTP_POST_FILES['ufile']['name']; = upload file name
//for example upload file name cartoon.gif . $path will be upload/cartoon.gif
$path1= "upload/".$HTTP_POST_FILES['ufile']['name'][0];
$path2= "upload/".$HTTP_POST_FILES['ufile']['name'][1];
$path3= "upload/".$HTTP_POST_FILES['ufile']['name'][2];
$path4= "upload/".$HTTP_POST_FILES['ufile']['name'][3];

//copy file to where you want to store file
copy($HTTP_POST_FILES['ufile']['tmp_name'][0], $path1);
copy($HTTP_POST_FILES['ufile']['tmp_name'][1], $path2);
echo copy($HTTP_POST_FILES['ufile']['tmp_name'][2], $path3);

//$HTTP_POST_FILES['ufile']['name'] = file name
//$HTTP_POST_FILES['ufile']['size'] = file size
//$HTTP_POST_FILES['ufile']['type'] = type of file
echo "File Name :".$HTTP_POST_FILES['ufile']['name'][0]."<BR/>";
echo "File Size :".$HTTP_POST_FILES['ufile']['size'][0]."<BR/>";
echo "File Type :".$HTTP_POST_FILES['ufile']['type'][0]."<BR/>";
echo "<img src=\"$path1\" width=\"150\" height=\"150\">";
echo "<P>";

echo "File Name :".$HTTP_POST_FILES['ufile']['name'][1]."<BR/>";
echo "File Size :".$HTTP_POST_FILES['ufile']['size'][1]."<BR/>";
echo "File Type :".$HTTP_POST_FILES['ufile']['type'][1]."<BR/>";
echo "<img src=\"$path2\" width=\"150\" height=\"150\">";
echo "<P>";

echo "File Name :".$HTTP_POST_FILES['ufile']['name'][2]."<BR/>";
echo "File Size :".$HTTP_POST_FILES['ufile']['size'][2]."<BR/>";
echo "File Type :".$HTTP_POST_FILES['ufile']['type'][2]."<BR/>";
echo "<img src=\"$path3\" width=\"150\" height=\"150\">";

///////////////////////////////////////////////////////

// Use this code to display the error or success.

$filesize1=$HTTP_POST_FILES['ufile']['size'][0];
$filesize2=$HTTP_POST_FILES['ufile']['size'][1];
$filesize3=$HTTP_POST_FILES['ufile']['size'][2];

if($filesize1 && $filesize2 && $filesize3 != 0)
{
echo "We have recieved your files";
}

else {
echo "ERROR.....";
}

//////////////////////////////////////////////

// What files that have a problem? (if found)

if($filesize1==0) {
echo "There're something error in your first file";
echo "<BR />";
}

if($filesize2==0) {
echo "There're something error in your second file";
echo "<BR />";
}

if($filesize3==0) {
echo "There're something error in your third file";
echo "<BR />";
}

?>

edit This is my array

Array ( [ufile] => Array ( [name] => Array ( [0] => stripe.jpg [1] => stripe.jpg ) [type] => Array ( [0] => image/jpeg [1] => image/jpeg ) [tmp_name] => Array ( [0] => D:\xampp\tmp\php29A9.tmp [1] => D:\xampp\tmp\php29AA.tmp ) [error] => Array ( [0] => 0 [1] => 0 ) [size] => Array ( [0] => 8717 [1] => 8717 ) ) ) 

Answer 1

Hate to state the obvious, but have you remembered to include the enctype attribute?

<form method="post" enctype="multipart/form-data" action="...php">

Without this, you'll never get a file upload; you'll only see the filename as the submitted value.

<input name="ufile[]" type="file" id="ufile[]" size="50" />

It's invalid to include square brackets in an id. Choose an id that includes only alphanumerics plus .-_, and begins with a letter. If you need to add an id to every generated element, make sure it's different each time. Although as far as I can see you're not actually using any of these IDs, so you could quite easily omit them all.

$path1= "upload/".$HTTP_POST_FILES['ufile']['name'][0];

EXTREME DANGER. The user can put anything in the filename, including .. (go up a directory) and active filetypes like .php. Never trust user-submitted filenames on your server's filesystem! Either strongly sanitise them (which is harder than you think), or, better, use a completely unrelated name to store it under.

Allowing users to upload files at all carries big risks. See this question for further discussion.

echo "File Name :".$HTTP_POST_FILES['ufile']['name'][0]."<BR/>";

This and every time you put a text string into HTML, you need to call htmlspecialchars() on it. Otherwise < and & characters in the string can include markup including script, and you've got a cross-site-scripting security hole.

Answer 2

Use Firebug's right click > "Inspect Element" to make sure the new input is in fact a child of your form. Otherwise, it won't be sent along.