php 多文件异步上传

Question

使用tp3.3做附件的异步上传,用的是uploadify插件,总体代码如下:

前台代码:

<form id="uploads" method="post" action="">
    <div id="queue">
    <input id="file_upload" name="file_upload[]" type="file" multiple="true">
    </div>
    <input type="submit" value="提交">
</form>

<script type="text/javascript">
    <?php $timestamp = time();?>
    $(function() {
        $('#file_upload').uploadify({
            'formData'     : {
                'timestamp' : '<?php echo $timestamp;?>',
                'token'     : '<?php echo md5('unique_salt' . $timestamp);?>'
            },
            'swf'      : '/oschina/Addons_Project/Addons/Public/Org/uploadify/uploadify.swf',
            'uploader' : 'http://localhost/oschina/Addons_Project/Addons/index.php/demo/index/uploads',
            'onUploadSuccess' : function(file, data, response) {
//                json字符串转换为josn对象
                var jsdata=$.parseJSON(data);
                var ht=jsdata.filename+'<input type="hidden" name="filepath[]" value="'+jsdata.path+'">&nbsp;&nbsp;&nbsp;&nbsp;<button type="button" onclick="delfile('+jsdata.path+')">x</button><br/>';
               $("#queue").append(ht);
            }
        });
    });
//    ajax异步删除文件
    function delfile(t){
        alert(t);
    }
</script>

后台代码:

 public function uploads(){
        //date("Y/m/d")和date("Y-m-d")生成路径的不同,/直接被转换成了目录层级
        $targetFolder = '/oschina/Addons_Project/Addons/Public/Uploads/Files/'.date("Y/m/d"); // Relative to the root
        $verifyToken = md5('unique_salt' . $_POST['timestamp']);

        if (!empty($_FILES) && $_POST['token'] == $verifyToken) {
            $tempFile = $_FILES['Filedata']['tmp_name'];
            $targetPath = $_SERVER['DOCUMENT_ROOT'] . $targetFolder;
            // 如果没有文件夹则进行创建,默认代码中没有
            is_dir($targetPath)||mkdir($targetPath,0777,true);
            //对文件名进行重命名
            $targetFile = rtrim($targetPath,'/') . '/' . md5(time()).$_FILES['Filedata']['name'];

            // Validate the file type
            $fileTypes = array('jpg','jpeg','gif','png','doc','xls'); // File extensions
            $fileParts = pathinfo($_FILES['Filedata']['name']);

            if (in_array($fileParts['extension'],$fileTypes)) {
                move_uploaded_file($tempFile,$targetFile);
                $data['path']=str_replace('E:/www/oschina/Addons_Project/Addons/','./',$targetFile);
                $data['filename']=$_FILES['Filedata']['name'];
                $jdata=json_encode($data);
                echo $jdata;
            } else {
                echo 'Invalid file type.';
            }
        }
    }

有几个问题:
1.前台代码中 function delfile(t){ alert(t);} alert(t);不能正常显示,我前面代码拼接的哪块有问题了?
2.这种文件上传实现办法存在什么问题,应该怎么改进一下.
3.我文件上传类型限制为'jpg','jpeg','gif','png','doc','xls',如果加入rar文件类型,如何限制恶意文件的上传,做到安全哪?

Answer 1

如果浏览器不支持flase插件，这个上传文件的方法就不能用