PHP-Quelltext

<br><br>
<?php
    require("check.php");
    include("config.php");
    if($action=="upload")
    {
        // Prüfen des Array $_FILES
        if (isset($_FILES["$form"])) 
        {
            // Upload-Status
            if ($_FILES["$form"]["error"] == UPLOAD_ERR_OK) 
            {
                // Muster zur Überprüfung der im Dateinamen
                // enthaltenen Zeichen (Optional)
                $regExp = "/^[a-z_]([a-z0-9_-]*\.?[a-z0-9_-])*\.[a-z]{3,4}$/i";
                // Dateiname und Dateigrösse
                if (preg_match($regExp,$_FILES["$form"]["name"]) && $_FILES["$form"]["size"] > 0 && $_FILES["$form"]["size"] < "$maxbytes") 
                {
                    // Hier wird der Dateiname der jeweiligen Datei in ein Array eingelesen.    
                    $array = explode(".", $_FILES["$form"]["name"]);
                    // Hier wird der Array gezählt
                    $maxarray=count($array)-1;
                    // Hier werden die nicht erlaubten Dateitypen gezählt
                    $max =count($notallow);
                    for($i=0;$i<$max;$i++)
                    {
                        if(!strcasecmp($array[$maxarray],$notallow[$i]) )
                        {
                            $true="arsch";
                        }
                    }
                    if($true=="arsch")
                    {
                        $echo="$errortyp";
                    }    
                    else
                    {
                        $abfrage = "SELECT `upid`,`userid`, `dateiname` FROM `itu2_upload` WHERE userid !='$id' ";
                        $ergebnis = mysql_query($abfrage);
                        while($row = mysql_fetch_object($ergebnis)) 
                        {
                            $db_upid[] = $row->upid;
                            $db_userid[] = $row->userid;
                            $db_dateiname[] = $row->dateiname;
                        }
                        $max =count($db_dateiname);
                        $filename=$_FILES["$form"]["name"];
                        for($i=0;$i<$max;$i++)
                        {
                            if($filename==$db_dateiname[$i])
                            {
                                $up="false";    
                                break;
                            }
                        }
                        if($up=="false")
                        {
                            $echo="$nowrite";
                        }
                        else 
                        {
                            // Temporäre Datei in das Zielverzeichnis des Servers verschieben.
                            move_uploaded_file($_FILES["$form"]["tmp_name"],"$pfad/".$_FILES["$form"]["name"]);
                            $eintrag = "INSERT INTO itu2_upload ( userid, dateiname) VALUES ('$id', '$filename')";
                            $eintragen = mysql_query($eintrag);
                            $echo="$uptrue";
                        }
                    }
                }
                else 
                {
                    $echo="$errordat";
                }
            }
            else
            {
                $echo="$errorup";
            }
        }
        else     
        {
            $echo="$errorfatal";
        }
    }
    else 
    {
?>
    <form action="<?php echo"dm.php?id=$id&session=$session&go=upload&action=upload"; ?>" enctype="multipart/form-data" method="post">
    <input type="file" name="dateiup" size="40" maxlength="10000">
    <input name="send" type="submit" value="Upload">
    </form>
<?php
    }
    ?>