Mysql file upload error?

Question

Here is my code to upload a file. Everything is working perfect. This code uploads the file to destination folder and MySQL query work perfect and insert all data into their relative fields in database. But it is not going to the page which is mentioned in header() function. It gives me an error at the end like this

Error: please try again, You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1' at line 1

I think it occurs when last if($exe) is executed

<?php

include('./includes/connection.php');

if(!$_POST['song_name']){
    header('location: pro_add.php');
    exit;
}

$path = "../upload_data/";
$uniqid = uniqid(strtotime('now'));
$uniq_name = $uniqid .'_'. $_FILES['file']['name'];

$complete_path = $path . $uniq_name;

$move = move_uploaded_file($_FILES['file']['tmp_name'],$complete_path);

if(!$move){
    echo 'Error: please try again'."<br/>";
}

$query = mysql_query("INSERT INTO products SET
    sub_cat_id='".$_POST['sub_cat_id']."',
    song_name='".$_POST['song_name']."',
    artist='".$_POST['artist']."',
    path='".$complete_path."' ");

$exe = mysql_query($query);

if($exe){
    header('location: products.php');
    exit;
}else{
    echo 'Error: please try again, <br />' . mysql_error();
}

?>

Why are you doing a mysql_query() on mysql_query()'s output. That's probably your problem. Also, start escaping your variables before putting them anywhere near the DB. — Jonnix
– Jonnix, Commented Sep 26, 2011 at 9:35
You also may want to read about en.wikipedia.org/wiki/SQL_injection and also mysql_real_escape_string() — Bruce
– Bruce, Commented Sep 26, 2011 at 9:37

Kokos · Accepted Answer · 2011-09-26 09:36:58Z

1

You are querying the result of your query:

$query = mysql_query('...');
$exe   = mysql_query($query);

Just replace $query = mysql_query('...'); with $exe = mysql_query('...') and it should work.

EDIT

As commenters on your question also pointed out, your script is extremely vulnerable to SQL Injection. You should read up on that before putting this online.

http://en.wikipedia.org/wiki/SQL_injection
http://php.net/manual/en/security.database.sql-injection.php

answered Sep 26, 2011 at 9:36

Kokos

9,1715 gold badges29 silver badges45 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Rukmi Patel · Accepted Answer · 2011-09-26 09:48:03Z

1

code is fine but it has only one problem. may be it has gone out of your mind...

 $query = mysql_query("INSERT INTO products SET
           sub_cat_id='".$_POST['sub_cat_id']."',
           song_name='".$_POST['song_name']."',
           artist='".$_POST['artist']."',
           path='".$complete_path."' ");

instead of this you should write

$query = "INSERT INTO products SET
          sub_cat_id='".$_POST['sub_cat_id']."',
          song_name='".$_POST['song_name']."',
          artist='".$_POST['artist']."',
          path='".$complete_path."'";

it will work fine if you replace this much of code..

answered Sep 26, 2011 at 9:48

Rukmi Patel

2,5619 gold badges29 silver badges42 bronze badges

Collectives™ on Stack Overflow

Mysql file upload error?

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related