PHP MySqli How to fix insert file with path in database?

Question

i'm inserting the path of the file (pdf) to the database and i'm saving the file to a folder ( files/contracts ). I'm doing something wrong since in my database (i'm using phpmyadmin ) under contracts it is showing like this: "files/contracts/TEST5.pdf" with the path to the folder. Also when i list it it is showing the path. Can you please help me?

This is the code i'm using for inserting:

$contract_path = mysqli_real_escape_string($conn, 'files/contracts/'.$_FILES['contractupload']['name']);

if (copy($_FILES['contractupload']['tmp_name'], $contract_path)){

$sql = "INSERT INTO addemployees (fname, lname, dob, embg, address, city, mobile, email, workplace, workposition, jobstartdate, contractfrom, contractto, healthbookfrom,
                                  healthbookto, contractupload, bankaccount, bank, workcode, gender, bloodtype, notes)
        VALUES ('$fname', '$lname', '$dob', '$embg', '$address', '$city', '$mobile', '$email', '$workplace', '$workposition', '$jobstartdate', '$contractfrom', '$contractto',
                '$healthbookfrom', '$healthbookto', '$contract_path', '$bankaccount', '$bank', '$workcode', '$gender', '$bloodtype', '$notes')";

This is all code:

<?php
$server = "localhost";
$user = "bale";
$pass = "blagojce";
$dbname = "employees";

// Create connection
$conn = mysqli_connect($server, $user, $pass, $dbname);

// Check connection
if (!$conn) {
    die("Connection failed: " . mysqli_connect_error());
}

$fname = mysqli_real_escape_string($conn, $_POST['fname']);
$lname = mysqli_real_escape_string($conn, $_POST['lname']);
$dob = mysqli_real_escape_string($conn, $_POST['dob']);
$embg = mysqli_real_escape_string($conn, $_POST['embg']);
$address = mysqli_real_escape_string($conn, $_POST['address']);
$city = mysqli_real_escape_string($conn, $_POST['city']);
$mobile = mysqli_real_escape_string($conn, $_POST['mobile']);
$email = mysqli_real_escape_string($conn, $_POST['email']);
$workplace = mysqli_real_escape_string($conn, $_POST['workplace']);
$workposition = mysqli_real_escape_string($conn, $_POST['workposition']);
$jobstartdate = mysqli_real_escape_string($conn, $_POST['jobstartdate']);
$contractfrom = mysqli_real_escape_string($conn, $_POST['contractfrom']);
$contractto = mysqli_real_escape_string($conn, $_POST['contractto']);
$healthbookfrom = mysqli_real_escape_string($conn, $_POST['healthbookfrom']);
$healthbookto = mysqli_real_escape_string($conn, $_POST['healthbookto']);
$bankaccount = mysqli_real_escape_string($conn, $_POST['bankaccount']);
$bank = mysqli_real_escape_string($conn, $_POST['bank']);
$workcode = mysqli_real_escape_string($conn, $_POST['workcode']);
$gender = mysqli_real_escape_string($conn, $_POST['gender']);
$bloodtype = mysqli_real_escape_string($conn, $_POST['bloodtype']);
$notes = mysqli_real_escape_string($conn, $_POST['notes']);
$contract_path = mysqli_real_escape_string($conn, 'files/contracts/'.$_FILES['contractupload']['name']);

if (copy($_FILES['contractupload']['tmp_name'], $contract_path)){

$sql = "INSERT INTO addemployees (fname, lname, dob, embg, address, city, mobile, email, workplace, workposition, jobstartdate, contractfrom, contractto, healthbookfrom,
                                  healthbookto, contractupload, bankaccount, bank, workcode, gender, bloodtype, notes)
        VALUES ('$fname', '$lname', '$dob', '$embg', '$address', '$city', '$mobile', '$email', '$workplace', '$workposition', '$jobstartdate', '$contractfrom', '$contractto',
                '$healthbookfrom', '$healthbookto', '$contract_path', '$bankaccount', '$bank', '$workcode', '$gender', '$bloodtype', '$notes')";

if (mysqli_query($conn, $sql)) {
  header("location: employees.php");

} else {
    echo "Error: " . $sql . "<br>" . mysqli_error($conn);
}

}
else {
    $_SERVER['message'] = 'File upload failed!';
}

//Close the connection
mysqli_close($conn);

?>

copy should be php.net/manual/en/function.move-uploaded-file.php — user3783243
– user3783243, Commented Dec 20, 2018 at 19:34
Why is “Can someone help me?” not an actual question?. — Funk Forty Niner
– Funk Forty Niner, Commented Dec 20, 2018 at 19:36
It inserts the path to the file to the database. And i dont know what i'm doing wrong or how to fix it. Please see the screenshots: i.imgur.com/g0NDBCz.png i.imgur.com/7wP8eMJ.png — Blagojce
– Blagojce, Commented Dec 20, 2018 at 21:01

Barmar · Accepted Answer · 2018-12-20 20:56:22Z

1

You told it to store $contract_path in the database, and on the previous line you set this to a path that begins with files/contracts.

If you want to store just the filename, put that in a different variable:

$contract_file = basename($_FILES['contractupload']['name']);
$contract_path = "files/contracts/$contract_file";
$contract_file = mysqli_real_escape_string($conn, $contract_file);

Then use $contract_file instead of $contract_path in the INSERT query.

BTW, it would be better to use parametrized queries instead of substituting variables into the query, even if you use mysqli_real_escape_string().

answered Dec 20, 2018 at 20:56

Barmar

789k57 gold badges555 silver badges669 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Blagojce Over a year ago

Thanks a lot @Barmar that worked :) But now instead of saving the files to the folder: "files/contracts" it saves them to the main folder. How can i fix this? Thanks

Barmar Over a year ago

Why does it do that? You weren't supposed to change the filename in copy(). BTW, you should use move_uploaded_file() instead of copy().

Blagojce Over a year ago

Upss :) Thank you very much @Barmar, that fixed my issue :) If i can ask you one more question please: Now, how can i show the file that i uploaded to my table ( the actual file so when i click on it, it can open in new tab/download )? This is my code: code Thanks a lot

Barmar Over a year ago

Write a download.php?id=XXX script, and add a link to that script around the filename.

Blagojce Over a year ago

Thanks a lot @Barmar.

Collectives™ on Stack Overflow

PHP MySqli How to fix insert file with path in database?

1 Answer 1

5 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

5 Comments

Your Answer

Sign up or log in

Post as a guest

Related