uploading images in php

Question

When I upload my images, It's throwing an error. How do I change permission settings of my folder in windows? Is there anything wrong with my code?

//This is my path for storing images. (I am using wamp 2.0)
$targetPath="../artistImages/";

$image=$_FILES['myimage'];
$image['name'] = mysql_real_escape_string($image['name']);
$targetPath.=$image['name'];

if(move_uploaded_file($image['tmp_name'],$targetPath)) {
   $insertQuery="INSERT INTO $tbl_name(ArtistImage)VALUES('".$image['name']."')";                       
   $result=mysql_query($insertQuery) or die("Failed to upload image");
}
else {
   echo "Could not upload file. Check read/write persmissions on the directory";
}

Answer 1

Your are trying to move a file to a path that has been mysql_real_escape_string()ed, which means it could potentially contain backslashes, which obviously will not work (at least, not in the way you expect it to).

Try this:

//This is my path for storing images. (I am using wamp 2.0)
$basePath = "../artistImages/";

$image = $_FILES['myimage'];
$storagePath = $basePath.$image['name'];

if (!is_dir($basePath)) {
  echo "Base path '$basePath' does not exist";
} else if (file_exists($storagePath)) {
  echo "File '$storagePath' already exists";
} else if (!move_uploaded_file($image['tmp_name'], $storagePath)) {
   echo "Could not move file to '$storagePath'. Check read/write persmissions on the directory";
} else {
   $insertQuery = "INSERT INTO `$tbl_name` (`ArtistImage`) VALUES ('".mysql_real_escape_string($image['name'])."')";
   if (!mysql_query($insertQuery)) die("DB insert failed: ".mysql_error());
}

Note that the above code has many error messages in that you would want remove, or at least water down before you put the code into any kind of environment where it would actually be used, but it should help you to debug the code while developing.

EDIT

If you actually do need to change the permissions on a folder, the method for doing it varies greatly between versions of Windows (actually it's pretty much identical for all 2K+ versions, but in some you may have to change some settings to get the correct dialogs to appear) and it would be a question for http://www.SuperUser.com/

Answer 2

You need to do a couple of things:

1- Make sure you test $tablename[ArtistImage] against a whitelist of tablenames before you inject it into your query.
If you don't you are still open to SQL-injection, because escaping only works for values, not for table or column names (or other SQL syntax) that you dynamically inject into your SQL-statements.

$tbl_name = ......
$allowed_tables = array('table1', 'table2');
if (in_array($tbl_name, $allowed_tables)) {
    $query = "......
} else { echo "tablename not allowed"; }

2 - Add a space between the tablename and VALUES

$insertQuery= "INSERT INTO `$tbl_name` VALUES('".$image['name']."')"; 

See: How to prevent SQL injection with dynamic tablenames?

A much simpler answer is to never let the user specify where a file should be saved, or how it is named (on the filesystem).
Follow @Marc B's advice and only store the desciption in the database and use the PK (id) as the filename.

$description = mysql_real_escape_string($_POST['description']);
$query = "INSERT INTO images (description) VALUES ('$description')"
$result = mysql_query($query);
$id = mysql_insert_id; //get the id you just inserted.
$filename = "../fixed_path/".$id.".jpg";
if (!move_uploaded_file($image['tmp_name'], $filename)) 
{ 
   echo "this should never happen" 
}