Meh, can't be bothered starting this documentation at work... Basically, your upload form has an input field with type "file". Once the form is submitted, the upload code should be processed...
// Filename variables
$upload_dir = "/var/www/html/secure/invoices/";
$temp_dir = "/var/www/html/secure/invoices/temp/";
$unique_id = md5(uniqid(time())) . "_";
$filename = basename($_FILES["invoice_new"]["name"]);
// Find out our invoice number from filename - filename should always be InvXXXXXXXX.pdf, where XXXXXXXX is the invoice number.
$invoice_num = substr($filename, 3, 8);
// Ensure that the uploaded invoice hasn't already been added to the database
$db_query = "SELECT * FROM `invoices` WHERE `invoice_num` = " . str_pad($invoice_num, 8, "0", STR_PAD_LEFT);
$db_result = run_query($db_query);
$invoice_test = mysql_num_rows($db_result);
if ($invoice_test > 0) {
echo "<p class=\"errortext\">This invoice has previously been uploaded</p>";
exit();
}
// Move the uploaded file to it's final location
if (!move_uploaded_file($_FILES["invoice_new"]["tmp_name"], $upload_dir . $unique_id . $filename)) {
echo "<p class=\"errortext\">New Invoice Upload Unsuccessful, or Possible File Upload Attack</p>";
exit();
}
// Other code goes here that does more stuff to the invoice system, including adding the onvoice details to the database..
(and yes, the filename doesn't quite have a 64 random char prefix like I said earlier, but it's good enough - you can add more chars if you wish)
Then, you have the code the retrieves the file from the filesystem using the info in the db. In this case, the "friendly" invoice number is being passed via a POST or GET method named "invoice_id"
// Determine what invoice is being requested....
// Retrieve invoice info from database
$db_query = "SELECT * FROM `invoices` WHERE `id` = '" . str_pad($_REQUEST["invoice_id"], 8, "0", STR_PAD_LEFT) . "' LIMIT 1";
$db_result = run_query($db_query);
$db_output = mysql_fetch_assoc($db_result);
if (!$db_output) { // If nothing was returned from the database, we have an error.
include("../../header.php");
?>
<p class="errortext">There was an error encountered while retrieving the invoice you requested.</p>
<?php
include("../footer.php");
exit();
}
$upload_dir = "/var/www/html/secure/invoices/";
header("Pragma: public");
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
header("Cache-Control: public");
header("Content-Description: File Transfer");
header('Content-type: application/pdf');
header('Content-Disposition: attachment; filename="Inv' . str_pad($db_output["invoice_num"], 8, "0", STR_PAD_LEFT) . '.pdf"');
header("Content-Transfer-Encoding: binary");
readfile($upload_dir . $db_output["filename"]);
In the above example, because the file is being sent as a download, it's important to make sure that no headers are passed to the browser other than the ones spat out by the header() function. But in your case, you'd only be retrieveing images inline with HTML, so you should have no need for that code.
This solution allows you to have cryptic names on the server, but users can still use friendly names to upload - and you don't have to worry about users overwriting files uploaded by someone else.