Extending PHP SQL Query does not work

Question

i am using Blueimp jQuery File Upload script and have this part of code which is working:

protected function handle_file_upload($uploaded_file, $name, $size, $type, $error,
        $index = null, $content_range = null) {
    $file = parent::handle_file_upload(
        $uploaded_file, $name, $size, $type, $error, $index, $content_range
    );
    if (empty($file->error)) {
        $sql = 'INSERT INTO `'.$this->options['db_table']
            .'` (`name`, `size`, `type`, `title`, `description`)'
            .' VALUES (?, ?, ?, ?, ?)';
        $query = $this->db->prepare($sql);
        $query->bind_param(
            'sisss',
            $file->name,
            $file->size,
            $file->type,
            $file->title,
            $file->description
        );
        $query->execute();
        $file->id = $this->db->insert_id;
    }
    return $file;
 }

Now i want to insert just one value which is Memberid. I extended the sql table succesfully with this column "usr_id" and modified the code like this:

     protected function handle_file_upload($uploaded_file, $name, $size, $type, $error,
        $index = null, $content_range = null) {
    $file = parent::handle_file_upload(
        $uploaded_file, $name, $size, $type, $error, $index, $content_range
    );
    if (empty($file->error)) {
        $sql = 'INSERT INTO `'.$this->options['db_table']
            .'` (`name`, `size`, `type`, `title`, `description`, `usr_id`)'
            .' VALUES (?, ?, ?, ?, ?, ';
        $sql = $sql. $_SESSION['Memberid'] .")";
        $query = $this->db->prepare($sql);
        $query->bind_param(
            'sisss',
            $file->name,
            $file->size,
            $file->type,
            $file->title,
            $file->description
        );
        $query->execute();
        $file->id = $this->db->insert_id;
    }
    return $file;
}

But it does not work. I never saw this way of inserting a sql query. I hope someone can help.

TIA :)

// EDIT

I also tried this now and it does not work too. What I am doing wrong?

     protected function handle_file_upload($uploaded_file, $name, $size, $type, $error,
        $index = null, $content_range = null) {
    $file = parent::handle_file_upload(
        $uploaded_file, $name, $size, $type, $error, $index, $content_range
    );
    if (empty($file->error)) {
        $sql = 'INSERT INTO `'.$this->options['db_table']
            .'` (`name`, `size`, `type`, `title`, `description`, `usr_id`)'
            .' VALUES (?, ?, ?, ?, ?, ?)';
        $query = $this->db->prepare($sql);
        $query->bind_param(
            'sisssi',
            $file->name,
            $file->size,
            $file->type,
            $file->title,
            $file->description,
            "2"
        );
        $query->execute();
        $file->id = $this->db->insert_id;
    }
    return $file;
}

Why don't you look at [the way the other values are getting added](http://ca1.php.net/manual/en/mysqli.quickstart.prepared-statements.php) to the query, and do the same thing? [You are potentially exposing yourself to SQL injection](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php?rq=1). — miken32, Feb 21 '14 at 22:28
Thank you for your Comment. I tried to do it like you said it. But it does not work. I have added the code to my first post. What I am doing wrong? TIA — user2096388, Feb 22 '14 at 08:40

score 0 · Accepted Answer · answered Feb 22 '14 at 10:55

According to the manual for 'bind_param' it must be passed variables. Alas, you passed a constant not a variable. i haven't tried the following code but it should do something sensible.

     protected function handle_file_upload($uploaded_file, $name, $size, $type, $error,
        $index = null, $content_range = null) {
    $file = parent::handle_file_upload(
        $uploaded_file, $name, $size, $type, $error, $index, $content_range
    );

    if (empty($file->error)) {
        $sql = 'INSERT INTO `'.$this->options['db_table']
            .'` (`name`, `size`, `type`, `title`, `description`, `usr_id`)'
            .' VALUES (?, ?, ?, ?, ?, ?)';
        $query = $this->db->prepare($sql);
        $usrId = 2; // temporary variable to store the usr_id
        $query->bind_param(
            'sisssi',
            $file->name,
            $file->size,
            $file->type,
            $file->title,
            $file->description,
            $usrId
        );
        $query->execute();
        $file->id = $this->db->insert_id;
    }
    return $file;
}

Thank you Ryan. It Works, i can insert "2" in db. But now i have another problem. It seems that $_SESSION['Memberid'] isnt accessible from this index.php file, but i dont know why. In other files $_SESSION['Memberid'] is working. Do you know why? — user2096388, Feb 22 '14 at 13:15
I have no idea why the session variable is not accessible. I suggest you check the session is started in the index script. also check in the other scripts to see where it is set. That will give you a clue as to what is happening. — Ryan Vincent, Feb 22 '14 at 14:34
Thats it! Thank you a lot Ryan! It is working perfectly. session_start(); was missing in index.php — user2096388, Feb 22 '14 at 17:07

Extending PHP SQL Query does not work

1 Answers1