How can I get an upload file from user to my database to specific user logged in?

Question

I have a feature below which is an upload picture feature which allows users to upload a picture of themselves. It is meant to upload the picture to a directory, and then store in a database (whichever user is logged in) and also should display for the user. What seems to be happening for me is that it is inserting into the database as an 'Array' but not sure who I can get it to link to UserID I have logged in?

See code below:

error_reporting(E_ALL);
ini_set('display_errors', 1);
include("dbConnect.php");

if(isset($_POST['submit'])) {
    $file = $_FILES['file'];

    $fileName = $_FILES['file']['name'];
    $fileTmpName = $_FILES['file']['tmp_name'];
    $fileSize = $_FILES['file']['size'];
    $fileError = $_FILES['file']['error'];
    $fileType = $_FILES['file']['type'];

    $fileExt = explode('.', $fileName);
    $fileActualExt = strtolower(end($fileExt));

    $allowed = array(
        'jpg',
        'jpeg',
        'png',
        'pdf'
    );
    if(in_array($fileActualExt, $allowed)) {
        if($fileError === 0) {
            if($fileSize < 1000000) {
                $fileNameNew = uniqid('', true) . "." . $fileActualExt;
                $fileDestination = 'uploads/' . $fileNameNew;
                move_uploaded_file($fileTmpName, $fileDestination);
                header("Location: myProfile.php?successCode=1");
                echo "<img src=" . $fileDestination . " height=200 width=300/>";
            } else {
                echo "your file too big";
            }
        } else {
            echo "There was error uploading file";
        }
    } else {
        echo "you cant upload files of this type";
    }
    // Insert record
    $stmt = $conn->prepare("INSERT into Profile(ProfilePicture) values('" . $file . "')");
    $stmt->execute();
}

GrumpyCrouton · Answer 1 · 2018-01-22T20:59:09.013

2

The problem is you are saving an array to your database. You cannot just save a picture to your database, but you CAN save the PATH to your image.

$stmt = $conn->prepare("UPDATE Profile SET ProfilePicture='{$fileName}' WHERE UserID='{$_SESSION['currentUserID']}'");

The above will save just the name of the file, so if your image directory never changes, this should be good enough and you can reference the actual directory in your code elsewhere.

-- "I want the code to insert the ProfilePicture where UserID=UserID logged in?" - In regards to this from the comments, I updated my answer to show you how to UPDATE the table where UserID='$_SESSION['currentUserID']'

NOTE: You should consider switching to prepared statements with parameterized variables, as the method currently in use may be vulnerable to SQL Injection.

edited Jan 22 '18 at 20:59

answered Jan 22 '18 at 20:41

GrumpyCrouton

8,486
7
32
71

ok thanks. do you know how i can then link this to upload to UserID who is logged in? – Becca Jan 22 '18 at 20:44
@Becca Is the UserID saved in a variable? – GrumpyCrouton Jan 22 '18 at 20:46
Yes each user logged in has 'UserID' – Becca Jan 22 '18 at 20:48
@Becca Simply save that variable to another column in the table? – GrumpyCrouton Jan 22 '18 at 20:49
UserID is in same table as ProfilePicture, i want the code to insert the ProfilePicture where UserID=UserID logged in? – Becca Jan 22 '18 at 20:53
@Becca I understand that. When your user logs in, do you assign their User ID to a `$_SESSION` value or anything? – GrumpyCrouton Jan 22 '18 at 20:53
Yes in the login: $_SESSION["currentUserID"]=$dbRow["UserID"]; – Becca Jan 22 '18 at 20:56
@Becca Okay. So what you want is actually an UPDATE query, check out my updated answer. – GrumpyCrouton Jan 22 '18 at 20:59
Tried this and it has not worked, nothing into the database. I have my ProfilePicture as Text? should it be something else? – Becca Jan 22 '18 at 21:04
@Becca That should be fine. Perhaps you should post a new question about your new issue since the question you asked here has been answered. – GrumpyCrouton Jan 22 '18 at 21:06

How can I get an upload file from user to my database to specific user logged in?

1 Answers1