upload + db

<?php 
$MAX_SIZE = 12000000; 
                            
$FILE_EXTS  = array('.mp3','.wma'); 

$DELETABLE  = true;                                


$site_name = $_SERVER['HTTP_HOST']; 
$url_dir = "http://".$_SERVER['HTTP_HOST'].dirname($_SERVER['PHP_SELF']); 
$url_this =  "http://".$_SERVER['HTTP_HOST'].$_SERVER['PHP_SELF']; 

$upload_dir = "download/"; 
$upload_url = $url_dir."/download/"; 
$message =""; 

if (!is_dir("download")) { 
  if (!mkdir($upload_dir)) 
     die ("upload_files directory doesn't exist and creation failed"); 
  if (!chmod($upload_dir,0755)) 
     die ("change permission to 755 failed."); 
} 

if ($_REQUEST[del] && $DELETABLE)  { 
  $resource = fopen("log.txt","a"); 
  fwrite($resource,date("Ymd h:i:s")."DELETE - $_SERVER[REMOTE_ADDR]"."$_REQUEST[del]\n"); 
  fclose($resource); 
  
  if (strpos($_REQUEST[del],"/.")>0);                  
  else if (strpos($_REQUEST[del],$upload_dir) === false); 
  else if (substr($_REQUEST[del],0,1)==$upload_dir) { 
    unlink($_REQUEST[del]); 
    print "<script>window.location.href='$url_this?message=deleted successfully'</script>"; 
  } 
} 
else if ($_FILES['userfile']) { 
  $resource = fopen("log.txt","a"); 
  fwrite($resource,date("Ymd h:i:s")."UPLOAD - $_SERVER[REMOTE_ADDR]" 
            .$_FILES['userfile']['name']." " 
            .$_FILES['userfile']['type']."\n"); 
  fclose($resource); 

  $file_type = $_FILES['userfile']['type']; 
  $file_name = $_FILES['userfile']['name']; 
  $file_ext = strtolower(substr($file_name,strrpos($file_name,"."))); 

  if ( $_FILES['userfile']['size'] > $MAX_SIZE) 
     $message = "Veľkosť súboru je cez 12 MB."; 
  else if (!in_array($file_ext, $FILE_EXTS)) 
     $message = "Sorry, $file_name($file_type) 	nesmie byť nahraný."; 
  else 
     $message = do_upload($upload_dir, $upload_url); 
  
  print "<script>window.location.href='$url_this?message=$message'</script>"; 
} 
else if (!$_FILES['userfile']); 
else 
   $message = "Invalid File Specified."; 

$handle=opendir($upload_dir); 
$filelist = ""; 
while ($file = readdir($handle)) { 
   if(!is_dir($file) && !is_link($file)) { 
      $filelist .= "<a href='$upload_dir$file'>".$file."</a> - URL: <b>$upload_url$file</b>"; 
      if ($DELETABLE) 
        
      $filelist .= " Added at  ".date("d-m H:i", filemtime($upload_dir.$file)) 
                   .""; 
                  
                   
$filelist .= " <a style='text-decoration:none; font-weight:bold'  href='?del=$upload_dir".urlencode($file)."' title='delete'>x</a>"; 
      $filelist .="<br>";  
      
   } 
}    
            
function do_upload($upload_dir, $upload_url) { 

   $temp_name = $_FILES['userfile']['tmp_name']; 
   $file_name = $_FILES['userfile']['name']; 
  $file_name = str_replace("\\","",$file_name); 
  $file_name = str_replace("'","",$file_name); 
   $file_path = $upload_dir.$file_name; 

   if ( $file_name =="") { 
     $message = "Invalid File Name Specified"; 
     return $message; 
  } 

  $result  =  move_uploaded_file($temp_name, $file_path); 
  if (!chmod($file_path,0777)) 
      $message = "change permission to 777 failed."; 
  else 
    $message = ($result)?"$file_name bol úspešne nahraný." : 
              "Niečo je zle s nahraním súboru."; 
  return $message; 
} 

?>