<?php
/**********************************
*
**      file directory list
*
**********************************/
function listthem($add)
{
  $t=$add;
  if ($handle = opendir($add))
  {
     while (($file = readdir($handle))!=FALSE)
     {
         $add.="/".$file;

         if (is_dir($add)==TRUE)
         {
             if($file!="." && $file!=".." && is_dir($add)==TRUE)
             {
                 echo "    <option value=\"".$add."\">".$add."</option>";
                 listthem($add);
             }
         }
         $add=$t;
     }
     closedir($handle);
  }
}
function getdir($add)
{
?>
 <input type="hidden" name="MAX_FILE_SIZE" value="200000">
upload limitations! less than 200KB。<p>
WHERE TO UPLOAD <select size="1" name="DIR">
        <option value="">.</option>
<?php listthem($add);?>
</select>
<?php
}

if($_POST['NAME']=="LuciferStar")//change your name for secu
{           //password is not required in this edition
 setcookie("TestCookies",md5($_POST['NAME']),time()+3600);

 $i=0;
 echo "  <form enctype=multipart/form-data action=savefile.php?NUMBER=".$_POST['NUMBER']." method=post>";
 ?>
 <?php $add="."; getdir($add);?>
 <?php
 while($i<$_POST['NUMBER'])
 {
   $file=sprintf("userfile%d",$i);
   $i++;
   echo "<p>File $i <input name=$file type=file> ";
 }
 echo "<input type=submit value=upload>";
}
else
{
?>
<form action="upload.php" method="post">
<p>USER <input name="NAME" type="text"></p>
<p>PASS &nbsp; <input name="PASS" type="password"></p>
<p>NUMBER <input name="NUMBER" type="text"></p>
<input type=submit>
</form>
<?php
}
?>
</p>  
</form>

<?php
function upload($form)
{
  $filename=$_FILES[$form]['name'];
  if($filename!=NULL)
  {
     $l=strlen($filename);
     $rest = substr($filename,$l-3 ,$l );

        if($_POST['DIR']!=NULL)  $filename=sprintf("%s/%s",$_POST['DIR'],$filename);
        else $filename=sprintf("%s",$filename);

     if (is_uploaded_file($_FILES[$form]['tmp_name']))
     {
        if(move_uploaded_file($_FILES[$form]['tmp_name'], $filename))
        {//echo $_FILES[$form]['tmp_name'];
           echo "<p>uploaded file: ".$_FILES[$form]['name']." done.";
           echo "<p>link:<a href=\"".$filename."\"></a>";
        }
     }
     else
     {
        echo "Possible file upload attack. Filename: " . $_FILES[$form]['name'];
     }
  }
}
$i=0;
while($i<$_REQUEST['NUMBER'])
{
$file=sprintf("userfile%d",$i);
upload($file);
$i++;
}
?>