Php form insert to Mysql, mail & upload in same form

Question

I have a php form that when working will insert into db, e-mail notification, and allow optional upload of document. The db & mail portion work, however the file upload does not. At one point I did get working a file upload on a separate page. Right now I have 'error_reporting(-1);' in php.ini, and in the Apache log file nothing is shown indicating where the fault lies. Am I trying to do too much in the same form? Is there a way to get more detailed error reporting to figure out what is going wrong?

<?php
include('connect.php');
if((isset($_POST['username']) && !empty($_POST['username']))
&& (isset($_POST['email']) && !empty($_POST['email']))
&& (isset($_POST['city']) && !empty($_POST['city']))
&& (isset($_POST['state']) && !empty($_POST['state']))
&& (isset($_POST['file1']) && !empty($_POST['file1']))
&& (isset($_POST['file2']) && !empty($_POST['file2']))){
//if((isset($_POST['username']) && (!empty($_POST['username']))) && (isset($_POST['email']) && !empty($_POST['email'])) && (isset($_POST['subject']) && !empty($_POST['subject']))){
    print_r($_POST);
    $username = $_POST['username'];
    $email = $_POST['email'];
    $city = $_POST['city'];
    $state = $_POST['state'];

    $name= $_FILES['file']['name'];
    $tmp_name= $_FILES['file']['tmp_name'];
    $submitbutton= $_POST['submit'];
    $position= strpos($name, "."); 
    $fileextension= substr($name, $position + 1);
    $fileextension= strtolower($fileextension);
    $file1= $_POST['file1'];

    $to = "someone@somewhere.com";
    $headers = "From : " . $email;

    if( mail($to, $username, $city, $headers)){
        echo "<strong>E-Mail Sent successfully, we will get back to you soon.</strong>";

        $query = "INSERT INTO `contact` (username, email, city, state, file1, file2) VALUES ('$username', '$email', '$city', '$state', '$zip', '$file1', '$file2')";
        $result = mysqli_query($connection, $query);

    if (isset($name)) {
    $path= 'uploads/';
    if (!empty($name)){
    if (move_uploaded_file($tmp_name, $path.$name)) {
    echo 'Uploaded!';
    }
    }
    }
    }
}

?>
<html><head></head><body>
<div class="container">

<form class="form-contact" method="POST" multipart/form-data>

<input type="name" name="username" id="inputusername" class="auto-style7" placeholder="Your Name" required><span class="auto-style6">
<input type="email" name="email" id="inputEmail" class="auto-style7" placeholder="Your E-Mail Address">
<input type="name" name="city" id="inputcity" class="auto-style7" placeholder="Your City">
<input type="name" name="state" id="inputstate" class="auto-style7" placeholder="Your State">

<p></p>
Select file1: <input type="file" name="file1"> 
Select file2: <input type="file" name="file2">
<br>
<button class="btn btn-lg btn-primary btn-block" type="submit">Send</button></form>
</div>
</body>
</html>

Add: `ini_set('display_errors', 1); ini_set('display_startup_errors', 1); error_reporting(E_ALL);` at the top, and report back with an error. — Blue, Feb 23 '18 at 20:12
Side note: Using `isset` and `!empty` is redundant when checking for fields. You only need `!empty` checks as it does its own isset check. — IncredibleHat, Feb 23 '18 at 20:17
If you have no hidden inputs, then just loop through the $_POST and make sure each one is not empty. That's a lot of code to check for empties. Also, try simply using HTML5 and just add required to the input, it will save your fingers much typing. — technology101010, Feb 23 '18 at 20:20
I'm pretty sure it all boils down to the malformed `enctype` that @Andrew mentioned. The browser is not sending the data properly. Also you are referencing `$_FILES['file']['tmp_name']` when your input is named `file1` and a second of `file2` (which isn't used in your code). — IncredibleHat, Feb 23 '18 at 20:25

Mikey · Answer 1 · 2018-02-24T18:58:59.083

Here's how I would revise your original code:

<?php
// turn on error reporting
error_reporting(E_ALL);
ini_set('display_errors', 1);

include('connect.php');

if ($_SERVER['REQUEST_METHOD'] === 'POST') {

    // trim all POSTed values
    $_POST = array_map('trim', $_POST);

    // no need to use isset() just use !empty()
    // note: empty('') is true, but empty(' ') is false hence why trimming is good to do
    if (!empty($_POST['username'])
        && !empty($_POST['email'])
        && !empty($_POST['city'])
        && !empty($_POST['state'])) {

        $username = $_POST['username'];
        $email = $_POST['email'];
        $city = $_POST['city'];
        $state = $_POST['state'];

        // now let's deal with the file inputs  
        // you have 2 file inputs with name attributes: file1 and file2

        // we'll store only validated files in an array
        $files = [];
        foreach (['file1', 'file2'] as $name) {
            // always check that it is a legit file
            // todo: add more validation and sanitization
            if (isset($_FILES[$name]['tmp_name'])
                && file_exists($_FILES[$name]['tmp_name'])
                && is_uploaded_file($_FILES[$name]['tmp_name'])
                && $_FILES[$name]['error'] === UPLOAD_ERR_OK) {
                $files[$name] = $_FILES[$name];
            }
        }

        $to = "someone@somewhere.com";
        $headers = "From : " . $email;

        if (mail($to, $username, $city, $headers)) {
            echo "<strong>E-Mail Sent successfully, we will get back to you soon.</strong>";
            // use prepared statements
            // todo: learn about SQL injection 
            $query = "INSERT INTO contact(username, email, city, state, file1, file2) VALUES (?, ?, ?, ?, ?, ?)";
            $stmt = mysqli_prepare($connection, $query);
            $stmt->bind_param("ssssss", 
                $username, 
                $email, 
                $city, 
                $state,
                // ensure files were provided before getting their names
                isset($files['file1']['name']) ? $files['file1']['name'] : '', 
                isset($files['file2']['name']) ? $files['file2']['name'] : ''
            );

            $stmt->execute();

            // upload the files
            $path= 'uploads/';
            foreach (['file1', 'file2'] as $name) {
                if (isset($files[$name]) 
                    && move_uploaded_file($files[$name]['tmp_name'], $path . $files[$name]['name'])) {
                    echo 'Uploaded!';
                }
            }
        }
    }
}
?>

Also your form should have an enctype attribute:

<form class="form-contact" method="POST" enctype="multipart/form-data">

Good to read

Php form insert to Mysql, mail & upload in same form

1 Answers1