Files not storing in the correct folder

Question

I created a page that can add new records to my database, everything is working fine but when I'm trying to upload a pdf file, it doesn't store to the correct folder. It should be stored in my "uploads". When I check my database, it doesnt link properly it should be ../uploads/example.pdf instead of example.pdf only

<?php

require('db.php');
include("auth.php");

$status = "";
if(isset($_POST['new']) && $_POST['new']==1)
{
$trn_date = date("Y-m-d H:i:s");
$fname =$_REQUEST['fname'];
$lname = $_REQUEST['lname'];
$memo = $_REQUEST['memo'];
$file = $_REQUEST['file'];
$submittedby = $_SESSION["username"];
$ins_query="insert into user (`trn_date`,`fname`,`lname`,`memo`,`submittedby`,`file`) values ('$trn_date','$fname','$lname','$memo','$submittedby','$file')";
mysqli_query($con,$ins_query) or die(mysql_error());
$status = "New Record Inserted Successfully.</br></br><a href='view.php'>View Inserted Record</a>";
}
?>
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8">
<title>Insert New Record</title>
<link rel="stylesheet" href="css/style.css" />
</head>
<body>
<div class="form">
<p><a href="dashboard.php">Dashboard</a> | <a href="view.php">View Records</a> | <a href="logout.php">Logout</a></p>

<div>
<h1>Insert New Record</h1>
<form name="form" method="post" action=""> 
<input type="hidden" name="new" value="1" />
<p><input type="text" name="fname" placeholder="Enter Date" required /></p>
<p><input type="text" name="memo" placeholder="Enter Memorandum" required /></p>
<p><input type="text" name="lname" placeholder="Enter Title" required /></p>
<form action="" method="POST" enctype="multipart/form-data">
         <input type="file" name="file" />
         <input type="submit"/>
      </form>
<?php
   if(isset($_FILES['file'])){
      $errors= array();
      $file_name = $_FILES['file']['name'];
      $file_size =$_FILES['file']['size'];
      $file_tmp =$_FILES['file']['tmp_name'];
      $file_type=$_FILES['file']['type'];
      $file_ext=strtolower(end(explode('.',$_FILES['file']['name'])));

      $expensions= array("pdf");

      if(in_array($file_ext,$expensions)=== false){
         $errors[]="extension not allowed, please choose a pdf file.";
      }

      if($file_size > 2097152){
         $errors[]='File size must not exceed 2 MB';
      }

      if(empty($errors)==true){
         move_uploaded_file($file_tmp,"../uploads/".$file_name);
         echo "Success";
      }else{
         print_r($errors);
      }
   }
?>

<p><input name="submit" type="submit" value="Submit" /></p>
</form>

<p style="color:#FF0000;"><?php echo $status; ?></p>
</div>
</div>
</body>
</html>

score 0 · Answer 1 · answered May 16 '17 at 08:16

0

That's because you set only to save file name

$file = $_REQUEST['file'];

Instead it should be

$file = "../uploads/".$_REQUEST['file'];

answered May 16 '17 at 08:16

b0ne

653
3
10

score 0 · Answer 2 · edited May 23 '17 at 12:34

0

There are quite a few logical errors in your code.

You are inserting a record into the MySQL database before you do your check on the file extension and file size.
You just insert the file name into MySQL ($file = $_REQUEST['file'];), hence only the file name appears there. The correct code would be:
```
$file = "../uploads/".$_FILES['file']['name'];
```

A bit more down you need to adjust the file move part:

    move_uploaded_file($file_tmp, $file);

In the error checking after the sql insert you use mysql_error(), not mysqli_error($con)
You do not check if the move_uploaded_file($file_tmp,"../uploads/".$file_name); call was successful and the file was moved to its final location.
Also pls consider using prepared statements to prevent sql injection attacks.

edited May 23 '17 at 12:34

Community

1
1

answered May 16 '17 at 08:20

Shadow

33,525
10
51
64

I already changed the $file = $_REQUEST['file']; into $file = "../uploads/".$_REQUEST['file']; and mysql to mysqli but it still doesnt store to correct path. What do you mean by not checking move_uploaded_file($file_tmp,"../uploads/".$file_name); call was successful? – Jay Doe May 16 '17 at 08:30
I'm sorry, but I'm not a mind reader. What path does the modified script store and why is not the correct one? Regarding your question on move_uploaded_file(): pls read the php manual: http://php.net/manual/en/function.move-uploaded-file.php – Shadow May 16 '17 at 08:34
Added further adjustments to the answer. – Shadow May 16 '17 at 08:39
Tried almost everything but the uploaded file doesnt move to the uploads folder. – Jay Doe May 16 '17 at 08:49
This is not something I can help you with. You need to check the relative path you use, the access rights to that folder, etc. Start by checking the return value of the move_uploaded_file(). – Shadow May 16 '17 at 08:53

Files not storing in the correct folder

2 Answers2