<?
$datetime=gettime('2');

$upload = $attachs = $attach_data = array();

if(isset($_FILES["file"]) && is_array($_FILES["file"]))
{
	//遍历每个附件
	foreach($_FILES["file"] as $k=>$v)
	{
		foreach($v as $id=>$var)
		{
			$upload[$id][$k]=$var;
			
		}
	}
	
}

	if($upload)
	{
		foreach($upload as $key=>$attach)
		{
			if(!($attach['tmp_name'] != 'none' && $attach['tmp_name'] && $attach['name'])) 
			{
				continue;
			}
			
		$attach["name"]=strtolower($attach["name"]);
		$attach["ext"]=getextension($attach["name"]);
		
		$filenamehash=md5(uniqid(microtime()));
		
		$attachdir="../../userfiles/fujian/";
		
		$attachsubdir="/userfiles/fujian/";
		
		if(!is_dir($attachdir))
		{
			mkdir($attachdir,0777);
			fclose(fopen($attachdir."index.htm","w"));
			chmod($attachdir,0777);
		}
		
		if(in_array($attach["ext"],array("php","asp","exe","html","htm","js")))
		{
			die("不允许上传此类型文件");
		}
		
		if(!in_array($attach["ext"],array("gif","jpg","png")))
		{
			$path=$attachdir.$filenamehash.".file";
			$filepath=$attachsubdir.$filenamehash.".file";
		}		
		else
		{
			$path=$attachdir.$filenamehash.".".$attach["ext"];
			$filepath=$attachsubdir.$filenamehash.'.'.$attach["ext"];
		}
		
		
		$attachment = upfile($attach['tmp_name'], $path);
		if(!$attachment)
		{
			die(" 上传附件错误");
		}
		
		$tmp_filesize = @filesize($attachment);
		if ($tmp_filesize != $attach['size'] && $attach['size']>2048) {
			@unlink($attachment);
			die('上传附件发生意外错误!');
		}
		//判断是否是图片格式
		
		if(in_array($attach['ext'],array('jpg','gif','png','jpeg')))
		{
			if($imginfo=@getimagesize($attachment))
			{
				if(!$imginfo[2] || !$imginfo['bits'])
				{
					@unlink($attachment);
					exit("不是一个有效的图片文件");
				}
				else
				{
					$isimage='1';
				}
			}
			else
			{
				exit("不是一个有效的图片文件");
			}
		}
		

		
		//将数据插入数据库
		
		$sql="insert into attachment (attach,uploadtime,filetype,filesize) value ('".addslashes($filepath)."','".$datetime."','".$attach["type"]."','".$attach["size"]."')";
																																							
		//echo $sql;																																			
		
		$mysql->query($sql);
		
		$id=$mysql->insert_id();
		
		
		
		$att[$id]=array
		(
			'id'=>$id,
			'uploadtime'=>$datetime,
			'type'=>$attach["type"],
			'size'=>$attach["size"]
		);
		
	 }
	 if(isset($att))
	 {
		$fileid=0;
		//echo $upload;
		foreach($att as $id=>$value)
		{
			$fileid.=",".$id;
		}
		$attach=$attach ? addslashes(serialize($att)) : "";
	 }
	else
	{
		//die("上传错误");
	}
	//echo $fileid;

	}
	else
	{
		die("上传错误");
	}

?>