php - Unable to store File details in Database -
i trying store uploaded file details in database. have written following code, unable understand why not reading query block. not generating mysql error message or other syntax error. kindly check it.
<head> <meta http-equiv="content-type" content="text/html; charset=utf-8" /> <title>untitled document</title> </head> <body> <form action="file_upload_test2.php" method="post" enctype="multipart/form-data"> <label for="file">filename:</label> <input type="file" name="file" id="file"><br> <input type="file" name="file2" id="file"><br> <input type="file" name="file3" id="file"><br> <input type="submit" name="submit" value="submit"> </form> </body> </html> <?php include 'connect.php'; $allowedexts = array("gif", "jpeg", "jpg", "png"); $extension = end(explode(".", $_files["file"]["name"])); if ((($_files["file"]["type"] == "image/gif") || ($_files["file"]["type"] == "image/jpeg") || ($_files["file"]["type"] == "image/jpg") || ($_files["file"]["type"] == "image/pjpeg") || ($_files["file"]["type"] == "image/x-png") || ($_files["file"]["type"] == "image/png")) //&& ($_files["file"]["size"] < 200000) && in_array($extension, $allowedexts)) { if ($_files["file"]["error"] > 0) { echo "return code: " . $_files["file"]["error"] . "<br>"; } else { echo "upload: " . $_files["file"]["name"] . "<br>"; echo "type: " . $_files["file"]["type"] . "<br>"; echo "size: " . ($_files["file"]["size"] / 200000) . " kb<br>"; $image_name= $_files["file"]["name"]; $path= move_uploaded_file($_files["file"]["tmp_name"], "upload/" . rand().$_files["file"]["name"]); echo "stored in: " . "upload/" . $_files["file"]["name"]; if (mysql_query ("insert category_images (image_name,image_location) values ('$image_name', '$path')")) { echo "successfull"; } else { mysql_error(); } } } else { echo "invalid file"; } ?>
try
$sql = "insert `category_images` (`image_name`,`image_location`) values ('".$image_name."', '".$path."')"; $result = mysql_query($sql); if ($result) { // successful query execution echo "successfull"; } else { // error occured while executing query. // show useful information using echo/print. // stop execution after taking other necessary steps die(mysql_error()); } also, database vulnerable sql injection attack since not sanitizing input. should use @ least mysql_real_escape_string() method ensure doesn't occur.
if above doesn't work, try checking if connection parameters ok , if mysql running.
Comments
Post a Comment