upload files

<?php[br]/**********************************[/br]*[br]**      file directory list[/br]*[br]**********************************/[/br]function listthem($add)[br]{[/br]   $t=$add;[br]   if ($handle = opendir($add))[/br]   {[br]      while (($file = readdir($handle))!=FALSE)[/br]      {[br]          $add.="/".$file;[br][/br]          if (is_dir($add)==TRUE)[/br]          { [br]              if($file!="." && $file!=".." && is_dir($add)==TRUE)[/br]              {[br]                  echo "    <option value=\"".$add."\">".$add."</option>";[/br]                  listthem($add);[br]              }[/br]          }[br]          $add=$t;[/br]      }[br]      closedir($handle); [/br]   }[br]}[/br]function getdir($add)[br]{[/br]?>[br]  <input type="hidden" name="MAX_FILE_SIZE" value="200000">[/br]upload limitations! less than 200KB。<p>[br]WHERE TO UPLOAD <select size="1" name="DIR"> [/br]         <option value="">.</option>[br]<?php listthem($add);?>[/br]</select>[br]<?php[/br]}[br][/br]if($_POST['NAME']=="LuciferStar")//change your name for secu[br]{           //password is not required in this edition[/br]  setcookie("TestCookies",md5($_POST['NAME']),time()+3600);[br][/br]  $i=0;[br]  echo "  <form enctype=multipart/form-data action=savefile.php?NUMBER=".$_POST['NUMBER']." method=post>";[/br]  ?>[br]  <?php $add="."; getdir($add);?>[/br]  <?php[br]  while($i<$_POST['NUMBER'])[/br]  {[br]    $file=sprintf("userfile%d",$i);[/br]    $i++;[br]    echo "<p>File $i <input name=$file type=file> ";[/br]  }[br]  echo "<input type=submit value=upload>";[br]}[/br]else[br]{[/br]?>[/br]<form action="upload.php" method="post">[br]<p>USER <input name="NAME" type="text"></p>[/br]<p>PASS &nbsp; <input name="PASS" type="password"></p>[br]<p>NUMBER <input name="NUMBER" type="text"></p>[/br]<input type=submit>[br]</form>[/br]<?php[br]}[/br]?>[br]</p>  [/br]</form>

<?php [/br]function upload($form)[br]{[/br]   $filename=$_FILES[$form]['name'];[br]   if($filename!=NULL)[/br]   {[br]      $l=strlen($filename);[/br]      $rest = substr($filename,$l-3 ,$l );[br][/br]         if($_POST['DIR']!=NULL)  $filename=sprintf("%s/%s",$_POST['DIR'],$filename);[br]         else $filename=sprintf("%s",$filename);[br][/br]      if (is_uploaded_file($_FILES[$form]['tmp_name'])) [/br]      { [br]         if(move_uploaded_file($_FILES[$form]['tmp_name'], $filename)) [/br]         {//echo $_FILES[$form]['tmp_name'];[br]            echo "<p>uploaded file: ".$_FILES[$form]['name']." done.";[/br]            echo "<p>link:<a href=\"".$filename."\"></a>";[br]         }[/br]      }[br]      else[/br]      {[br]         echo "Possible file upload attack. Filename: " . $_FILES[$form]['name'];[/br]      }[br]   }[/br]}[br]$i=0;[/br]while($i<$_REQUEST['NUMBER'])[br]{[/br]$file=sprintf("userfile%d",$i);[br]upload($file);[/br]$i++;[br]}[/br]?>