MySQL database insertion error

Question

I am working on a project to upload images into a directory and store image paths in database table. The image upload work fine but my text input for name is not working. I need your help.

if(isset($_POST['upload']))
{

$path=$path.$_FILES['file_upload']['name'];

if(move_uploaded_file($_FILES['file_upload']['tmp_name'],$path))
{
echo " ".basename($_FILES['file_upload']['name'])." has been uploaded<br/>";
echo '<img src="gallery/'.$_FILES['file_upload']['name'].'" width="48" height="48"/>';
$img=$_FILES['file_upload']['name'];
    $query="insert into imgtables (name,imgurl,date) values('$name',STR_TO_DATE('$dateofbirth','%d-%m-%y'),'$img',now())";
    if($sp->query($query)){
     echo "<br/>Inserted to DB also";   
    }else{
        echo "Error <br/>".$sp->error;       
    }
}
else
{
echo "There is an error,please retry or ckeck path";
}
}

?>

The form is as follows:

<form action="gallery.php" method="post" enctype="multipart/form-data">
<table width="384" border="1" align="center">

<tr>
<td width="108">Name</td>
<td><input type="text" name="name"></td>
</tr>
<tr>
<td width="108">Select File</td>
<td width="260"><label><input type="file" name="file_upload"></label></td>
</tr>
<tr>
<td></td>
<td><label><input type="submit" name="upload" value="Upload File"></label></td>
</tr>
</table>
</form>

When I echo($query) there is no error indicated since some columns (imgurl and date) are successfully populated, except for one column called name. — Joseph Bupe, Nov 04 '14 at 12:47
And where do you set `$name`? It's not set in the provided code sample (unless `register_globals` is on, but that would be rather bad ...). — Sirko, Nov 04 '14 at 12:50

score 1 · Accepted Answer · edited May 23 '17 at 11:49

1

Obviously the variable $name is empty or undefined and this is why all the other columns are populated and not this one. Also since the query is valid you don't get any error.

You can confirm this with a simple :

echo($name);

Not related to your problem :

Your code seems vulnerable to SQL injection : use prepared statement to prevent this.
Is register_globals turned on? If so you should really consider turning it off. To know why, have a look at Why is REGISTER_GLOBALS so bad?.

edited May 23 '17 at 11:49

Community

1
1

answered Nov 04 '14 at 13:18

ForguesR

3,558
1
17
39

Thank you. I isset the variables and now it's working. But, I need to prepared statement now. Regards – Joseph Bupe Nov 04 '14 at 14:08

MySQL database insertion error

1 Answers1