title: tinyMCE Image Upload to Directory Fails when $_POST['imageDIR'] used in postAcceptor.php
body: <p>Somewhat new to tinyMCE and javascript.  Would like to understand why the php image upload program supplied by the tinyMCE site does not work when I try to use the php $_POST[] superglobal to reference a directory name.  </p>
  
  <p>The <code>$_POST['imageDIR']</code> is the directory to store the images when added to the tinyMCE text area.  It works when I use <code>$imageFolder = "images3/";</code> - images get stored in that directory.  When I use <code>$imageFolder = $_POST['imagesDIR'];</code> ,where the $_POST value is set in another file (such as 'images45/'), the directory is NOT created, and the image is stored in the textarea as a base64 image string.  </p>
  
  <p>Trying to echo anything in the postAcceptor.php script to troubleshoot, also causes the same failure.</p>
  
  <p>The tinyMCE config file is shown below (right from the tinyMCE website example):</p>
  
  <pre><code>tinymce.init({
    selector: '#article',
    plugins: 'image code,autoresize',
    menubar:false,
    statusbar: false,
    toolbar: 'undo redo | link image | code',
    // enable title field in the Image dialog
    image_title: true, 
    // enable automatic uploads of images represented by blob or data URIs
    automatic_uploads: true,
    // URL of our upload handler (for more details check: https://www.tinymce.com/docs/configure/file-image-upload/#images_upload_url)
    images_upload_url: 'postAcceptor.php',
    // here we add custom filepicker only to Image dialog
    file_picker_types: 'image', 
    // and here's our custom image picker
    image_advtab: true,
    file_picker_callback: function(cb, value, meta) {
      var input = document.createElement('input');
      input.setAttribute('type', 'file');
      input.setAttribute('accept', 'image/*');
  
      // Note: In modern browsers input[type="file"] is functional without 
      // even adding it to the DOM, but that might not be the case in some older
      // or quirky browsers like IE, so you might want to add it to the DOM
      // just in case, and visually hide it. And do not forget do remove it
      // once you do not need it anymore.
  
      input.onchange = function() {
        var file = this.files[0];
  
        var reader = new FileReader();
        reader.onload = function () {
          // Note: Now we need to register the blob in TinyMCEs image blob
          // registry. In the next release this part hopefully won't be
          // necessary, as we are looking to handle it internally.
          var id = 'imageID' + (new Date()).getTime();
          var blobCache =  tinymce.activeEditor.editorUpload.blobCache;
          var base64 = reader.result.split(',')[1];
          var blobInfo = blobCache.create(id, file, base64);
          blobCache.add(blobInfo);
  
          // call the callback and populate the Title field with the file name
          cb(blobInfo.blobUri(), { title: file.name });
        };
        reader.readAsDataURL(file);
      };
  
      input.click();
    }
  
  });
  </code></pre>
  
  <p>The postAcceptor.php file is shown below (also from the tinyMCE website example):</p>
  
  <pre><code>&lt;?php
    /*******************************************************
     * Only these origins will be allowed to upload images *
     ******************************************************/
    $accepted_origins = array("http://localhost", "http://192.168.1.1", "http://example.com");
  
    /*********************************************
     * Change this line to set the upload folder *
     *********************************************/
    $imageFolder = "images3/"; //----WORKS!!!
    $imageFolder = $_POST['imagesDIR']; //--NO WORK!!! 
    /*********************************************/  
  
    if (!file_exists($imageFolder)) {
      mkdir($imageFolder, 0777, true);
  }
    reset ($_FILES);
    $temp = current($_FILES);
    if (is_uploaded_file($temp['tmp_name'])){
      if (isset($_SERVER['HTTP_ORIGIN'])) {
        // same-origin requests won't set an origin. If the origin is set, it must be valid.
        if (in_array($_SERVER['HTTP_ORIGIN'], $accepted_origins)) {
          header('Access-Control-Allow-Origin: ' . $_SERVER['HTTP_ORIGIN']);
        } else {
          header("HTTP/1.1 403 Origin Denied");
          return;
        }
      }
  
      /*
        If your script needs to receive cookies, set images_upload_credentials : true in
        the configuration and enable the following two headers.
      */
      // header('Access-Control-Allow-Credentials: true');
      // header('P3P: CP="There is no P3P policy."');
  
      // Sanitize input
      if (preg_match("/([^\w\s\d\-_~,;:\[\]\(\).])|([\.]{2,})/", $temp['name'])) {
          header("HTTP/1.1 400 Invalid file name.");
          return;
      }
  
      // Verify extension
      if (!in_array(strtolower(pathinfo($temp['name'], PATHINFO_EXTENSION)), array("gif", "jpg", "png"))) {
          header("HTTP/1.1 400 Invalid extension.");
          return;
      }
  
      // Accept upload if there was no origin, or if it is an accepted origin
      $filetowrite = $imageFolder . $temp['name'];
      move_uploaded_file($temp['tmp_name'], $filetowrite);
  
      // Respond to the successful upload with JSON.
      // Use a location key to specify the path to the saved image resource.
      // { location : '/your/uploaded/image/file'}
      echo json_encode(array('location' =&gt; $filetowrite));
    } else {
      // Notify editor that the upload failed
      header("HTTP/1.1 500 Server Error");
    }
  ?&gt;
  </code></pre>
  
  <p>Any help to explain why the <code>$_POST</code> variable causes this failure would be appreciated.  Any suggestion as to how this could be done would help - my end goal is to be able to save the images in a directory named after the article ID, stored in a database.  The article ID changes depending on which article is called up from the database.  I have also tried to use the <code>$_SESSION['imagesDIR']</code> variable, which also did not work.</p>