Creating unique names for uploaded images I am trying to create a unique name for my uploaded images. It works, but I wonder whether I should make a few changes or not.

HTML

    &lt;form action="upload.php" method="post" enctype="multipart/form-data" name="uploadform"&gt;
        &lt;input type="hidden" name="MAX_FILE_SIZE" value="350000"&gt;
        &lt;input name="picture" type="file" id="picture" size="50"&gt;
        &lt;input name="upload" type="submit" id="upload" value="Upload Picture!"&gt;
    &lt;/form&gt;


PHP

// if something was posted, start the process... 
if (isset($_POST['upload'])) {

// define the posted file into variables 
    $name = $_FILES['picture']['name'];
    $tmp_name = $_FILES['picture']['tmp_name'];
    $type = $_FILES['picture']['type'];
    $size = $_FILES['picture']['size'];

// if your server has magic quotes turned off, add slashes manually 
    if (!get_magic_quotes_gpc()) {
        $name = addslashes($name);
    }

// open up the file and extract the data/content from it 
    $extract = fopen($tmp_name, 'r');
    $content = fread($extract, $size);
    $content = addslashes($content);
    fclose($extract);

// connect to the database 
    include "../cn/connect.php";

    $name = md5($name);
    $name = $name . uniqid($name);

    $path = $_FILES['picture']['name'];
    $ext = pathinfo($path, PATHINFO_EXTENSION);
    $name = $name.".".$ext;

// the query that will add this to the database 
    $stmt = $sqli-&gt;prepare("INSERT INTO image1(name, type, size) VALUES (?,?,?)");
    $stmt-&gt;bind_param("sss", $name, $_FILES['picture']['type'], $_FILES['picture']['size']);
    $stmt-&gt;execute();
    $stmt-&gt;close();
    echo "Mission has been completed, sir!";

    if (!empty($_FILES)) {
        $target = "upload/";
        $target = $target . basename($_FILES['picture']['name']);
        $ok = 1;
        $picture_size = $_FILES['picture']['size'];
        $picture_type = $_FILES['picture']['type'];
        //This is our size condition 
        if ($picture_size &gt; 5000000) {
            echo "Your file is too large.&lt;br&gt;";
            $ok = 0;
        }


        //This is our limit file type condition 
        if ($picture_type == "text/php") {
            echo "No PHP files&lt;br&gt;";
            $ok = 0;
        }

        //Here we check that $ok was not set to 0 by an error 
        if ($ok == 0) {
            Echo "Sorry your file was not uploaded";
        } //If everything is ok we try to upload it
        else {
            if (move_uploaded_file($_FILES['picture']['tmp_name'], $target)) {
                echo "The file " . basename($_FILES['picture']['name']) . " has been uploaded &lt;br/&gt;";
            } else {
                echo "Sorry, there was a problem uploading your file.";
            }
        }
    }

    echo "Successfully uploaded your picture!";
} else {
    die("No uploaded file present");
}
It looks like your code works fine, so these comments are my opinion on how I would handle this if I were in your shoes.

This is a pretty standard requirement. Users upload images, and you want to save them with a filename that is (a) unique, and (b) won't cause you grief down the road with funny characters in the file name.

You also need to handle the case where people upload files with the same name over and over again, without creating duplicates.  For instance, for a certain model of camera the first photo on the "camera roll" might always have the same name. Several people might own the same model of camera. Or, dissatisfied with the results of uploading an image, the user edits it locally and uploads a fresh copy. With the same file name as before.

The simplest solution is to skip all the md5 and uniqid() stuff, and simply add a record to a database which has an auto-increment ID field. You would add the original name of the image to the database (for future reference, tooltip etc), but not the name of the file on disk. Once you get the new ID, you copy/move/rename the image file based on the new ID. This gives you nice short, simple file names.

I think this is tidier than inventing a unique file name before adding the database record. Databases have a built-in unique ID feature, so you can get a unique ID "for free!" with each new record. Why invent your own?

If the name of the image file ends up being used in URL's, so you don't want it to be easily guessable, then you want to mess up the file name to make it more complicated. If this is the case, you are better off placing the files where they are not accessible directly via URL.

If you, as an administrator, want to be able to browse through the image files and have the names make sense, or if you want the image names to appear in the URL to assist visitors or for SEO or Google Image search benefits, then you may want to name the images like blog post titles, i.e. simple lower-case-hyphen-separated words with a unique ID on the end. There is lots of code around that will do that for you. (I've got code if you can't find it elsewhere).