1

Ok. I have searching on this site Since August 24 2011.(not that it matters) for a way to display files that have been uploaded by a user. I have my form on the admin side and everything is working fine. I also have a table displaying whatever the user has filled in the form which also works. But I can not view the file or its name on the table.

My database table has a primary id auto_increment int(11) unsigned.

Here is the code I wrote:

//This gets all the other information from the form 
$company=$_POST['company']; 
$location=$_POST['location'];
$pic=($_FILES['userfile']['name']);

$query = "INSERT INTO user_DB VALUES ('','$company', '$location', '$userfile' )";

//target to the path of my files
$target_path = "uploads/post_id/";
if(!is_dir($target_path)) mkdir($target_path);
$uploadfile = $target_path . basename($_FILES['userfile']['name']);

//Move the uploaded file to $taget_path
(move_uploaded_file($_FILES['userfile']['tmp_name'], $uploadfile));

On the form which you fill in the details I have the following:

<tr>
<td><label for="company_name">Company Name</label></td>
<td><input type="text" name="company" id="company" value="" size="38" /></td>
</tr>
<tr>
<td><label for="location">Location</label></td>
<td><input type="text" name="location" id="location" value="" /></td>
</tr>
<tr>
<td>Upload a File:</td>
<td><input name="userfile" id="userfile" type="file" /></td>
</tr>

The table which is on the front end that displays the query results looks like this, just the file feild.

echo "<td>";
echo "<a href=../admin/uploads/post_id/> $row'userfile'</a>";
echo "</td>";

So as you can see I am trying to get the file name as well as the file itself. If its a pdf/ jpg/doc I should be able to view/download it when I click the link.

Ant ideas ...

Anele
  • 162
  • 1
  • 3
  • 21
  • Also make sure to restrict the allowed file types. If the user were to upload a PHP file they could execute it on your server. – diolemo Aug 31 '11 at 09:51
  • @freshwire how can I be able to do thi? As i have realise I only want doc/pdf and jpg files to be uploaded.. do u have a link maybe I can visit?? Please assist. – Anele Aug 31 '11 at 12:07
  • This has [been asked](http://stackoverflow.com/questions/5427222/finding-extension-of-uploaded-file-php) many times. – diolemo Sep 01 '11 at 06:34

4 Answers4

6

Some suggestions for what you could change to get this working.

1. Upload form

What does your form tag look like? Don't forget to include the enctype parameter as per below:

<form type="post" action="" enctype="multipart/form-data">
    ...
</form>

2. Sanitisation

$company  = mysql_real_escape_string($_POST['company']); 
$location = mysql_real_escape_string($_POST['location']);
$pic      = mysql_real_escape_string($_FILES['userfile']['name']);

The above lines are the first step in helping to prevent your queries from suffering SQL injection attacks.

3. SQL Query

$userfile does not exist as you have actually assigned the file name to $pic instead so your query should look like this:

$query = "INSERT INTO user_DB 
          VALUES ('','$company', '$location', '$pic')";

4. HTML Output

Now to link to the file in your output table:

echo "<td>";
echo "<a href=" . $target_path . basename($row['userfile']) . ">
         {$row['userfile']}</a>";
echo "</td>";
Treffynnon
  • 21,365
  • 6
  • 65
  • 98
  • Thank you very much Treffnnon... code works :) I can see the file name on my output table – Anele Aug 31 '11 at 10:34
  • @Anele That is great! Please mark this as the answer and give it an up vote. Thank you. – Treffynnon Aug 31 '11 at 10:53
  • @Treffynnon How do I do that. I relatively new to the website as well. – Anele Sep 01 '11 at 14:48
  • @Anele to up vote click the dark grey up arrow that appears beside each answer. To accept an answer click the light grey tick mark beside the answer you wish to accept. There is a little screenshot and more description here: http://meta.stackexchange.com/questions/5234/how-does-accepting-an-answer-work/5235#5235 – Treffynnon Sep 01 '11 at 14:51
2

i think sould replace this

$query = "INSERT INTO user_DB VALUES ('','$company', '$location', '$userfile' )";

with

$query = "INSERT INTO user_DB VALUES ('','$company', '$location', '$pic' )";
Haim Evgi
  • 123,187
  • 45
  • 217
  • 223
2

Something very basic that you might have missed is the form enctype. Many begginers does this. So just check if you have the enctype attribute in the form.

<form enctype="multipart/form-data">

Only if you have this you can upload files through your forms. Another place where you could possibly gone wrong is 

$query = "INSERT INTO user_DB VALUES ('','$company', '$location', '$userfile' )";

You store the file name in a variable called $pic but here you have given $userfile so just try changing that into $pic.

swordfish
  • 4,899
  • 5
  • 33
  • 61
0

you can use one column as auto_increament

when you are inserting a new user than you can get sum of already registered users using this query

$qry = mysql_qyery("select * from users"); and you can get user count by using

$count = mysql_num_rows($qry); so after this you insert a new user and his ID will be

$count1 = $count+1; $id = 'F'.$count1;

suganya
  • 1
  • 3