unable to insert url in mysql database using php

Question

Html code:

<input type="file" class="form-control" name="video[]" placeholder=" Enter Image file">
<div><h2>OR</h2></div>
<input type="text" class="form-control" name="yurl" placeholder=" Enter youtube embedded code">
<button type='submit' name="save" class='btn btn-success waves-effect waves-light'><i class='fa fa-upload'></i> Save</button>

php code:

<?php
if(isset($_POST['save'])){
    $yurl = ($_POST['yurl']); 
    $new_data=mysqli_real_escape_string($connection, stripslashes($yurl));
    echo $yurl;
    foreach($_FILES["video"]["tmp_name"] as $key=>$tmp_name){
        $temp = $_FILES["video"]["tmp_name"][$key];
        $name = $_FILES["video"]["name"][$key];
        if(empty($temp))
        {
            break;
        }

        move_uploaded_file($temp,"../uploads/galleryvideos/".$name); 
        $sql = "INSERT INTO gallaryvids (video ,youtube)
        VALUES ('$name', '$yurl')";

        if (mysqli_query($connection,$sql)) {
?>
        <script>
            window.location.href = "view_gal_video.php";

        </script>
<?php
        }
    }   
}

?>

Url which I want to insert: https://youtu.be/sA0-QXbLnaE

both video and link get inserted when i only want to insert link not a video it fails but don't gives any error

Your script is wide open to [SQL Injection Attack](http://stackoverflow.com/questions/60174/how-can-i-prevent-sql-injection-in-php) Even [if you are escaping inputs, its not safe!](http://stackoverflow.com/questions/5741187/sql-injection-that-gets-around-mysql-real-escape-string) Use [prepared parameterized statements](http://php.net/manual/en/mysqli.quickstart.prepared-statements.php) — RiggsFolly, Mar 08 '18 at 09:58
Errrr Is that No to getting the Vid or NO to connection to database — RiggsFolly, Mar 08 '18 at 10:03
**What** You changed No to Yes and now I understand even less — RiggsFolly, Mar 08 '18 at 10:06
Also, you do realise that you are outputting the `` in the loop so you will run `n` javascript redirects all in one big bang — RiggsFolly, Mar 08 '18 at 10:14
if your `mysqli_query()` call returns `false` then you can check what went wrong by using `mysqli_error()` — ADyson, Mar 08 '18 at 10:27

PPL · Accepted Answer · 2018-03-08T12:43:53.607

Updated code with database connection.

if(isset($_POST['save'])){

$servername = "localhost";
$username = "root";
$password = "";
$dbname = "";

// Create connection
$conn = new mysqli($servername, $username, $password, $dbname);
// Check connection
if ($conn->connect_error) {
    die("Connection failed: " . $conn->connect_error);
} 

$yurl = $_POST['yurl'];
//$video='test';


foreach($_FILES["video"]["tmp_name"] as $key=>$tmp_name){
        $temp = $_FILES["video"]["tmp_name"][$key];
        $name = $_FILES["video"]["name"][$key];
        if(empty($temp))
        {
            break;
        }
        move_uploaded_file($temp,"../uploads/galleryvideos/".$name); 


$sql = "INSERT INTO gallaryvids (video, youtube)VALUES ('$name', '$yurl')";

if ($conn->query($sql) === TRUE) {
    echo "New record created successfully";
} else {
    echo "Error: " . $sql . "<br>" . $conn->error;
}

$conn->close();
}

thank you.It Works.But There is still an issue not an error.When i only want to insert url not a video it did not insert the url. — sumit shelar, Mar 08 '18 at 12:37
@sumitshelar you should at least upvote or accept the answer, downvote does not make sense — PPL, Mar 08 '18 at 12:38

unable to insert url in mysql database using php

1 Answers1