SWAMPy

✎ CARVE FLESH

EDITING: upload.php

<?php
require_once __DIR__ . '/../config.php';

/**
 * Validates and stores an uploaded image from $_FILES[$field].
 * Returns the generated filename (not the full path/URL) on success.
 * Throws RuntimeException with a user-facing message on failure.
 */
function store_uploaded_image(string $field, string $prefix = 'img'): string
{
    if (!isset($_FILES[$field]) || $_FILES[$field]['error'] === UPLOAD_ERR_NO_FILE) {
        throw new RuntimeException('No file was uploaded.');
    }

$file = $_FILES[$field];

if ($file['error'] !== UPLOAD_ERR_OK) {
        throw new RuntimeException('Upload failed (error code ' . $file['error'] . ').');
    }

if ($file['size'] > MAX_UPLOAD_BYTES) {
        throw new RuntimeException('File is too large. Max size is ' . (MAX_UPLOAD_BYTES / 1024 / 1024) . 'MB.');
    }

$finfo = finfo_open(FILEINFO_MIME_TYPE);
    $mime = finfo_file($finfo, $file['tmp_name']);
    finfo_close($finfo);

if (!in_array($mime, ALLOWED_MIME_TYPES, true)) {
        throw new RuntimeException('Only JPG, PNG or WEBP images are allowed.');
    }

$extMap = ['image/jpeg' => 'jpg', 'image/png' => 'png', 'image/webp' => 'webp'];
    $ext = $extMap[$mime];

$filename = $prefix . '-' . bin2hex(random_bytes(8)) . '.' . $ext;
    $destination = UPLOAD_DIR . $filename;

if (!is_dir(UPLOAD_DIR) && !mkdir(UPLOAD_DIR, 0755, true)) {
        throw new RuntimeException('Server error: uploads folder is not writable.');
    }

if (!move_uploaded_file($file['tmp_name'], $destination)) {
        throw new RuntimeException('Server error: could not save the uploaded file.');
    }

return $filename;
}

function image_url(?string $filename): ?string
{
    if (!$filename) {
        return null;
    }
    return UPLOAD_URL . rawurlencode($filename);
}

CANCEL

Name	Type	Size	Modified	Actions
↩ ..	DIR	—	—
📄 api_auth.php	PHP	1.5 KB	2026-09-09 10:08	EDIT
📄 cors.php	PHP	1.7 KB	2026-09-09 10:08	EDIT
📄 upload.php	PHP	2 KB	2026-09-09 10:08	EDIT