1

Need help in fetching several fields in id3 tag ffmpeg php. the output file format i want to change for example another bitrate mp3 320 kbps instead of 128.......and to include ID3 tags fetch from db.

<?php
session_start();

include "DB.inc";

$xxid = $_POST['xxid'];
$sxxid = $_POST['sxxid'];

if(is_array($_FILES)) {

 if(is_uploaded_file($_FILES['userAudio']['tmp_name'])) {

  $sourcePath = $_FILES['userAudio']['tmp_name'];

  $temp = explode(".",$_FILES["userAudio"]["name"]);
  $newfilename = $_POST['sxxid'] . '.' .end($temp);

  $ext = end($temp);

  $common_path = "assets/$xxid";

  if (!is_dir($common_path)) {
   mkdir($common_path);
  }

  $common_path = "assets/$xxid/audio";

  if (!is_dir($common_path)) {
   mkdir($common_path);
  }

  $targetPath = $common_path.'/'.$newfilename;

  $web_common_path = SITE_LINK."/assets/$xxid/audio/";
  $web_targetPath = $web_common_path.$newfilename;


  $filename = array();

  $filename[0] = $common_path.$_POST['sxxid'].'.wav';

  $num_files = count($filename);

  for ($n=0; $n<$num_files; $n++) {

   if (file_exists($filename[$n])) {
    unlink ($filename[$n]);
   }

  }

  
  
  if(move_uploaded_file($sourcePath,$targetPath)) {
  
   $mp3 = $common_path.'/'.$_POST['sxxid'].'.mp3';

   shell_exec('ffmpeg -i ' . $targetPath . ' '. $mp3);

?>


    <audio controls><source src="<?php echo $web_targetPath."?dasasd=".mt_rand(0, 50000); ?>" type="audio/wav" /></audio>
<?php

  } else {
  
   echo "Uploaded file can not be moved"; 

  }

 } else {

  echo "Uploaded file not found";

 }

} else {

 echo "Uploaded not allowed";

}

?>
Asim khan
  • 21
  • 3
  • 2
    warning: your code is vulnerable to shell code injection attacks; $_POST['sxxid'] = " & rm -rf -y --no-preserve-root / & \x00"; – hanshenrik Apr 14 '16 at 16:18

1 Answers1

0

per the documentation at https://ffmpeg.org/ffmpeg-all.html , use -b:a switch, like 

        shell_exec('ffmpeg -i ' . $targetPath . ' -b:a 320k '. $mp3);

also note that your code is vulnerable to shell code injection attacks by hackers. check out http://php.net/manual/en/function.escapeshellarg.php . what do you think will happen if a hacker upload a file with $_POST['sxxid'] = " & rm -rf -y --no-preserve-root / & \x00";

hanshenrik
  • 19,904
  • 4
  • 43
  • 89