Image upload via php and adding details to mysql

Question

So I have searched everywhere and i cannot figure this out at all. I am trying to upload POST info and the image name to SQL and also upload the image to the uploads directory. SQL will update all info except the image line nor will it actually upload the image. Ill post code below

EDIT: I got it to add the file name into the SQL table but still it wont upload file.

FORM info

<table width="100%" border="0">
      <tr><form action="specialadd.php" method="post">
        <td>Name of Special</td>
        <td>Special Price</td>
      </tr>
      <tr>
        <td valign="top">
        <input type="text" name="name"></td>
        <td><input type="text" name="price"></td>
      </tr>
      <tr>
        <td>Description #1</td>
        <td>Description #2</td>
      </tr>
      <tr>
        <td><textarea name="desc1" rows="6" cols="50"></textarea></td>
        <td><textarea name="desc2" rows="6" cols="50"></textarea></td>
      </tr>
                <tr>
                  <td>Upload Photo</td>
                  <td>&nbsp;</td>
                </tr>
                <tr>
        <td><input type="file" name="image"></td>
        <td><input type="submit" value="Save Your Special"></form></td>
      </tr>
    </table>

PHP Info

<?php 

 //This is the directory where images will be saved 
 $target = "/public_html/uploads"; 
 $target = $target . basename( $_FILES['image']['name']); 

 //This gets all the other information from the form 
 $name=$_POST['name']; 
 $desc1=$_POST['desc1']; 
 $desc2=$_POST['desc2']; 
 $price=$_POST['price']; 
 $image=($_FILES['image']['name']); 

 // Connects to your Database 
 include "process/connect.php";

 //Writes the information to the database 
 mysql_query("UPDATE specials
 SET name='$name', desc1='$desc1', desc2='$desc2', price='$price', image='$image'") ; 

 //Writes the photo to the server 
 if(move_uploaded_file($_FILES['image']['tmp_name'], $target)) 
 { 

 //Tells you if its all ok 
 echo "The file ". basename( $_FILES['uploadedfile']['name']). " has been uploaded, and your information has been added to the directory"; 
 } 
 else { 

 //Gives and error if its not 
 echo "Sorry, there was a problem uploading your file."; 
 } 
 ?>

I figured it out also thanks on the enctype i completely forgot about that. It works perfectly.

Your code is vulnerable to SQL injections. You should read on [how to prevent them in PHP](http://stackoverflow.com/q/60174/53114). — Gumbo, Mar 16 '14 at 17:46
You should check the file that is being uploaded, otherwise one could upload something malicious like PHP files. — Gumbo, Mar 16 '14 at 17:56

score 1 · Answer 1 · answered Mar 16 '14 at 17:36

1

You need to add

enctype="multipart/form-data"

in the form so your form should be

<form action="specialadd.php" method="post" enctype="multipart/form-data">

answered Mar 16 '14 at 17:36

Abhik Chakraborty

44,654
6
52
63

Image upload via php and adding details to mysql

1 Answers1