Insert Into is not saving file names

Question

Can anyone let me know what I am doing wrong here. While UPDATE is working fine on php5.5 Insert Into is not saving the file name to the database... All other fields are being saved without any issue. Thank you in advance

 if ($_GET['act']=="Add") {
 $uploaddir = '/pictures/';
          $uploaddir = $uploaddir . basename($_FILES['foto']['name']);
      $file=basename($_FILES['foto']['name']);
         move_uploaded_file($_FILES['foto']['tmp_name'], $uploaddir);
     chmod("$path/pictures/$file",0755);



$title= $_POST['title'];
$intro= $_POST['intro'];
$subtitle= $_POST['subtitle'];
$full= $_POST['full'];
$photodesc= $_POST['photodesc'];
$pq= $_POST['pq'];
$pq2= $_POST['pq2'];
$pq3= $_POST['pq3'];
$pq4= $_POST['pq4'];
$pq5= $_POST['pq5'];
$pq6= $_POST['pq6'];
$pq7= $_POST['pq7'];
$pq8= $_POST['pq8'];
$pq9= $_POST['pq9'];
$pq10= $_POST['pq10'];
$category= $_POST['category'];



$insertquery="INSERT INTO news_publish (`title`, `subtitle`, 
`category`, `intro`, `full`, `pq`, `photo`, `sdate` , `ldate`, `frontpage`, 
`photodesc`, `pq2`, `pq3`, `pq4`, `pq5`,`pq6`, `pq7`, `pq8`,`pq9`,`pq10`) 

values ('$title', '$subtitle', '$category', '$intro', '$full', '$pq', 
'$file', '$sdate', '$ldate', '$frontpage', 
'$photodesc','$pq2','$pq3','$pq4', 
'$pq5','$pq6','$pq7','$pq8','$pq9','$pq10')";

  mysqli_query($connect, $insertquery) or die('Error: ' . mysqli_error($connect));



            echo "Page Added<br>
            Please wait a second, or <a href=\"?go=editremove\">click here</a> ";
            echo "<meta http-equiv=\"refresh\" content=\"1;URL=?go=editremove\">";

    }

OK Page adding is now working with one image upload however when I try to upload multiple files, it saves file names to the database properly but it uploads two images as one image and name it like "image1.jpgimage2.jpg".

This is how I am uploading multiple files

 $uploaddir = $uploaddir . basename( $_FILES['foto']['name']);
          $uploaddir = $uploaddir . basename( $_FILES['foto2']['name']);
          $uploaddir = $uploaddir . basename( $_FILES['foto3']['name']);
          $uploaddir = $uploaddir . basename( $_FILES['foto4']['name']);
          $uploaddir = $uploaddir . basename( $_FILES['foto5']['name']);
          $uploaddir = $uploaddir . basename( $_FILES['foto6']['name']);
          $uploaddir = $uploaddir . basename( $_FILES['foto7']['name']);
          $uploaddir = $uploaddir . basename( $_FILES['foto8']['name']);
          $uploaddir = $uploaddir . basename( $_FILES['foto9']['name']);
          $uploaddir = $uploaddir . basename( $_FILES['foto10']['name']);
          $uploaddir = $uploaddir . basename( $_FILES['pdf']['name']);
          $uploaddir = $uploaddir . basename( $_FILES['katalog']['name']);


      $file=basename( $_FILES['foto']['name']);
      $file2=basename( $_FILES['foto2']['name']);
      $file3=basename( $_FILES['foto3']['name']);
      $file4=basename( $_FILES['foto4']['name']);
      $file5=basename( $_FILES['foto5']['name']);
      $file6=basename( $_FILES['foto6']['name']);
      $file7=basename( $_FILES['foto7']['name']);
      $file8=basename( $_FILES['foto8']['name']);
      $file9=basename( $_FILES['foto9']['name']);
      $file10=basename( $_FILES['foto10']['name']);
      $file11=basename( $_FILES['pdf']['name']);
      $file12=basename( $_FILES['katalog']['name']);


                   chmod("$uploaddir/$file",0755);
            chmod("$uploaddir/$file2",0755);
            chmod("$uploaddir/$file3",0755);
            chmod("$uploaddir/$file4",0755);
            chmod("$uploaddir/$file5",0755);
            chmod("$uploaddir/$file6",0755);
            chmod("$uploaddir/$file7",0755);
            chmod("$uploaddir/$file8",0755);
            chmod("$uploaddir/$file9",0755);
            chmod("$uploaddir/$file10",0755);
            chmod("$uploaddir/$file11",0755);
            chmod("$uploaddir/$file12",0755);



    move_uploaded_file($_FILES['foto']['tmp_name'], $uploaddir);
    move_uploaded_file($_FILES['foto2']['tmp_name'], $uploaddir);
    move_uploaded_file($_FILES['foto3']['tmp_name'], $uploaddir);            
    move_uploaded_file($_FILES['foto4']['tmp_name'], $uploaddir);   
    move_uploaded_file($_FILES['foto5']['tmp_name'], $uploaddir);   
    move_uploaded_file($_FILES['foto6']['tmp_name'], $uploaddir);   
    move_uploaded_file($_FILES['foto7']['tmp_name'], $uploaddir);   
    move_uploaded_file($_FILES['foto8']['tmp_name'], $uploaddir);   
    move_uploaded_file($_FILES['foto9']['tmp_name'], $uploaddir);   
    move_uploaded_file($_FILES['foto10']['tmp_name'], $uploaddir);  
    move_uploaded_file($_FILES['pdf']['tmp_name'], $uploaddir); 
    move_uploaded_file($_FILES['katalog']['tmp_name'], $uploaddir);

[Your script is at risk for SQL Injection Attacks.](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Learn about [prepared](http://en.wikipedia.org/wiki/Prepared_statement) statements for [PDO](http://php.net/manual/en/pdo.prepared-statements.php) and [MySQLi](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php). — Jay Blanchard, Sep 21 '15 at 14:54
*That there's a **BIG 10-4** there good buddy!* - @JayBlanchard — Funk Forty Niner, Sep 21 '15 at 14:59
*"Tell you what..."* Add error reporting to the top of your file(s) right after your opening PHP tag for example ` — Funk Forty Niner, Sep 21 '15 at 15:04
question is: does the file ever get uploaded in the first place? If not, well then.... fix that and your insert just might work. You're also chmod'ing before attempting to move the file to the folder. — Funk Forty Niner, Sep 21 '15 at 15:11
@JohnHatcher you need to tell us how you solved your initial problem and then you need to ask a new question relating to uploading multiple files at once. But you should check if there is an answer already as there probably is. — Martin, Sep 21 '15 at 21:05

Martin · Answer 1 · 2015-09-21T15:40:25.397

2

$file11 and $file12 are not defined in the script you have shown, yet are used as values to insert into the database.

You want to update:

$pdf= $_POST['file11'];
$catalog= $_POST['file12'];

because the variables you are inserting are not the variables declared here.

Your overall approach is also full of security risks and flaws and the links given in comments by Jay Blanchard should all be read and taken on board.

Edit:

Ok, so possible points for why the values are not being inserted into the database:

Do a print_r($file); and see what the value is before the MySQL is run. Does this show what you expect?
Have you checked that your database SQL column is the correct type, you're not trying to insert a string value into a integer column or suchlike.
Check that your column doesn't have Keys on it stopping you inserting non-unique data (I know this is very, very unlikely for your level of MySQL usage but...) .
Do as Fred-ii- mentioned, and set some error reporting on the page. such as with: error_reporting(E_ALL); ini_set('display_errors', 1);
Check that your $_FILES['foto']['error'] value is zero. Is your form correctly setup in HTML to accept file uploads? If you are not sure then please Google "How to upload files with HTML forms".
As Fred-ii- mentions, you need to use $_POST or $_GET variables but not both, if you are POSTing a form you should not be using GET variables in the command line. Clarify your form actions.

Finally:

Once you've established that you need to set your enctype="multipart/form-data" then you really, really need to read up on how to use PHP properly, as well as closing the various security flaws on your script and then implementing cleaner and tidier coding to make future debugging easier for all of us.

edited Sep 21 '15 at 15:40

answered Sep 21 '15 at 15:00

Martin

22,212
11
70
132

1

*"@Fred-ii- undefined variables? Which ones? – John Hatcher 1 min ago"* - I guess they have them. – Funk Forty Niner Sep 21 '15 at 15:01
Yeah that fields were updated... However I don't have problem with them. $file=basename($_FILES['foto']['name']); This field $file is not being saved to the database. I will look into security issue later. – John Hatcher Sep 21 '15 at 15:04
@Fred-ii- I saw OPs reply to you as I was writing my answer.... hopefully this provides some clarity for them. – Martin Sep 21 '15 at 15:04
2

@Martin whenever I see the word "file" and $_POST and $_GET together, it makes me raise a brow, just like "Mr. Spock" does ;-) – Funk Forty Niner Sep 21 '15 at 15:05
Please ignore these two $pdf= $_POST['file11']; $catalog= $_POST['file12']; I have updated the code... $file=basename($_FILES['foto']['name']); This field $file is not being saved to the database. – John Hatcher Sep 21 '15 at 15:08
If you don't have time to look into the security issue now, when will you find the time to do it later @JohnHatcher? – Jay Blanchard Sep 21 '15 at 15:12
@JohnHatcher I have updated my answer. Please check through and DO the edits and see what results they provide you/us – Martin Sep 21 '15 at 15:15
I've still no word on [this comment yet...](http://stackoverflow.com/questions/32698321/insert-into-is-not-saving-file-names#comment53240421_32698321) – Funk Forty Niner Sep 21 '15 at 15:16
indeed @Fred-ii- , I would bet money that OP has not set the correct `enctype`. – Martin Sep 21 '15 at 15:17
*"Once you've established that you need to set your enctype="multipart/form-data""* - Good answer Martin, I must agree. However, that's **IF** also the OP's method is using a POST method. Files do not get processed using GET, which is all the more reasons my "other" brow is raising even higher seeing their "GET". The question is way too unclear for my taste. – Funk Forty Niner Sep 21 '15 at 15:17
Good spot of the $_POST/$_GET ambiguity issue. @Fred-ii- – Martin Sep 21 '15 at 15:18
@Martin Yeah, but it's hard to say though, since there is a way to use both GET/POST, however the most important part of the form would be to explicitly imply a POST method. If it is omitted from it, well... I'm sure you know that forms default to GET if omitted. We'll just let the OP go through everything and see what comes of it. Error reporting should have thrown an undefined index somewhere, should that be the case. – Funk Forty Niner Sep 21 '15 at 15:20
The rest of OPs variables are posted with $_POST so I think he's posting to a *page.php?act=add* but its still a horrid way of doing it. I think the issue is centred on the FILE handling, .... oooh the anticipation..... – Martin Sep 21 '15 at 15:21
Guys.. Thanks for all the answer.. This is very old website over 10 years and I just started making the changes so that it works on php5.5.. Please allow me sometime to go over all these answer and get back. When you place this code error_reporting(E_ALL); ini_set('display_errors', 1); it states that title, intro and full are undefined however it saves without any issue. – John Hatcher Sep 21 '15 at 15:22
@JohnHatcher Once you have more information to share with us can you **EDIT** your original question and put the additional info. at the bottom similar to how I have added extra content to my answer. It's hard to read code / information in comments. Cheers – Martin Sep 21 '15 at 15:23
@Martin IT works now in php5.5 however it only works with one file upload. When I try to upload more than one file/image, it saves the file names to the database but it uploads two files as one file and name it like "image1.jpgimage2.jpg" I will Edit the original post – John Hatcher Sep 21 '15 at 17:27
@JohnHatcher you need to research how to properly implement multiple file uploads, it is not the syntax that you are using. – Martin Sep 21 '15 at 17:38

Insert Into is not saving file names

1 Answers1

Edit:

Finally: