Using PHP to upload an image and store data in MSSQL

Question

I'm attempting to upload an image as well as add details such as; title, description and filepath into a database table.

I'm using the following code, but it isn't adding any data to the database;

(The session.php include contains the database connectivity.)

<?php include('includes/session.php');

$uploadDir = 'submitted/pictures/';

if(isset($_POST['submit']))
{
$fileName = $_FILES['file']['name'];
$tmpName  = $_FILES['file']['tmp_name'];
$fileSize = $_FILES['file']['size'];
$fileType = $_FILES['file']['type'];

$filePath = $uploadDir . $fileName;

$result = move_uploaded_file($tmpName, $filePath);
if (!$result) {
echo "Error uploading <strong>file</strong>";
exit;
}

if(!get_magic_quotes_gpc())
{
    $fileName = addslashes($fileName);
    $filePath = addslashes($filePath);
}

$title = $_POST['title'];
$description = $_POST['description'];

$query = "INSERT INTO $user_pictures (file, title, description) VALUES ('$filePath', '$title', '$description')";

mssql_query($query); 

}

?>

The form code;

<form name="Image" enctype="multipart/form-data" action="upload-pics2.php" method="POST">
 Title <input type="text" name="title" maxlength="100" class="textbox" value="<?php echo $form->value("title"); ?>" />
 Description <textarea name="description" rows="8" cols="40" class="textbox" value="<?php echo $form->value("description"); ?>"></textarea>
 File <input type="file" name="file" accept="image/gif, image/jpeg, image/x-ms-bmp, image/x-png" size="26" class="textbox" />
 <input type="submit" name="submit" value="Upload" class="button" />
</form>

I was wondering if someone could tell me what might be going wrong?

Thank you.

are you trying to store the file in the db or just the path? your question suggests you want to store the data inside the db, but your code says you're just storing the path — pxl
– pxl, Commented Oct 11, 2009 at 9:41

Max S. Yarchevsky · Accepted Answer · 2009-10-09 14:02:43Z

1

This code do not work because of several problems.

First, you should rename one of html fields or change field name when you are checking for upload:

<input type="submit" name="Upload" value="Upload" class="button" />

or

if(isset($_POST['submit']))

Second one, this script will not store any data into DB. You should get, sanitize and write data into according fields, for example:

$title = mysql_real_escape_string($_POST['title']);
$description = mysql_real_escape_string($_POST['description']);
$query = "INSERT INTO $user_pictures (file, title, description) VALUES ('$filePath', '$title', '$description')";

You should make sure these fields present in DB, if not - you should create them:

ALTER table user_pictures ADD column description text, add column title varchar(255);

answered Oct 9, 2009 at 14:02

Max S. Yarchevsky

1012 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

doubleplusgood Over a year ago

Hey Max, is there an MSSQL equivalent to mysql_real_escape_string ?

doubleplusgood Over a year ago

Now seem to be getting this error; Warning: mssql_query() [function.mssql-query]: message: Incorrect syntax near '('. (severity 15) in upload-pics2.php on line 31

Max S. Yarchevsky Over a year ago

no, there is no equivalent to escape mssql, but you can use simple escaping function: function mssql_escape_string($string_to_escape) { $replaced_string = str_replace("'","''",$string_to_escape); return $replaced_string; } and then call $title = mssql_escape_string($_POST['title']); $description = mssql_escape_string($_POST['description']);

Max S. Yarchevsky Over a year ago

I have no ideas on that warning, sorry. :( Only can recommend to check syntax of the query.

doubleplusgood Over a year ago

No worries Max. Got it working now, just need to put some validation in to check for correct file type, file size and to display a success/error messages.

antyrat · Accepted Answer · 2009-10-09 13:52:50Z

1

You has an error at this line if(isset($_POST['Upload']))

Change this to the if(isset($_POST['submit']))

answered Oct 9, 2009 at 13:52

antyrat

27.7k9 gold badges78 silver badges77 bronze badges

Comments

dotty · Accepted Answer · 2009-10-09 13:57:32Z

1

is the 'submitted/pictures/' writable? also you might want to run is_uploaded_file() for an extra layer of security.

Also your query seems to be wrong

"INSERT INTO $user_pictures ( file ) VALUES ('$filePath')"

$user_pictures needs to be a table

try

"INSERT INTO `user_pictures` ( `file` ) VALUES ('$filePath')"

answered Oct 9, 2009 at 13:57

dotty

41.7k67 gold badges155 silver badges197 bronze badges

1 Comment

doubleplusgood Over a year ago

@dotty Thanks for that. Apparently file is a keyword, so i will have to change that.

Collectives™ on Stack Overflow

Using PHP to upload an image and store data in MSSQL

3 Answers 3

5 Comments

Comments

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

5 Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related