PHP: I can't update my database through $_POST with a $var inside

Question

I've been attempting to create a shop page where each item has a picture to it. Everything works well except when I upload an image, some of the information I want uploaded into my database will not actually be uploaded, I'm sure I've gotten something wrong for being new to this, after some research, trial and error I figure I should just ask!

In this line:

$qry = "INSERT INTO table_img (itemID, ext) VALUES 
('$_POST[$id]','$_POST[$fileActualExt]')";

The values of $id and $fileActualExt will not be updated in the database. I can't for the life of me figure out why, but I need these two in order to properly display any image I upload. Thanks in advance!

<?php

//This is from another table, used to link the two IDs together so the picture //and item will always be using the same ID. Right now I rely on auto_increment //due to my updating my table not working.
$id = $row['item_ID'];


if (isset($_POST['submit'])) {
    $file = $_FILES['file'];

    $fileName = $file['name'];
    $fileTmpName = $file['tmp_name'];
    $fileSize = $file['size'];
    $fileError = $file['error'];
    $fileType = $file['type'];

    $fileExt = explode('.', $fileName);
    $fileActualExt = strtolower(end($fileExt));

    $allowed = array('jpg', 'jpeg', 'png');

    if (in_array($fileActualExt, $allowed)) {
        if ($fileError === 0) { 
            if ($fileSize < 10000000) {
                echo "File successfully uploaded";

                $fileNameNew = "img".$id.".".$fileActualExt;
                $fileDestination = 'uploads/'.$fileNameNew;

                move_uploaded_file($fileTmpName, $fileDestination);


                $qry = "INSERT INTO table_img (itemID, ext) VALUES ('$_POST[$id]','$_POST[$fileActualExt]')";

                mysql_query($qry);

                echo "     $id, abc $fileActualExt";



            } else {
                echo "Your file is too big.";
            }

        } else {
            echo "There was an error uploading your file.";
        }

    } else {
        echo "You cannot upload files of this type. Please use JPG, JPEG or PNG.";
    }
}?>

please don't create shop page like this, your code is SQL injectable. — tanaydin, Feb 16 '18 at 16:03
This is only a first page I'm creating for a school project- we have some form of eased injection protection doc inside, but this won't go public forever. — Blubb, Feb 16 '18 at 16:06
Also look at **Complex (curly) syntax** http://php.net/manual/en/language.types.string.php#language.types.string.parsing — AbraCadaver, Feb 16 '18 at 16:09
You should read about MySQLi or PDO DB connections, ideally PDO. — Jordi Vicens, Feb 16 '18 at 16:13

PHP: I can't update my database through $_POST with a $var inside

0 Answers0