PHP upload errors

Question

I have an upload script that's causing me some problems and I can't for the life of me figure out why. Here's the php code:

mysql_connect('localhost', 'root', '');
mysql_select_db('uploads');

if (isset($_FILES["file"]["type"]) && isset($_FILES["file"]["size"])) {
if (($_FILES["file"]["type"] == "image/png")) {
    if ($_FILES["file"]["size"] < 500120) {
        if ($_FILES["file"]["error"] > 0) {
            echo $_FILES["file"]["error"];
        } else {                         
            if (file_exists("uploads/" . $_FILES["file"]["name"])) {
               echo $_FILES["file"]["name"] . " already exists. ";
            } else {
                move_uploaded_file($_FILES["file"]["tmp_name"], "uploads/" . $_FILES["file"]["name"]);
                $name = $_FILES["file"]["name"];
                mysql_query("INSERT INTO uploads (name) VALUES ('$name')");                 
                if (isset($_POST['title']) && isset($_POST['desc'])) {
                    $title = $_POST['title'];
                    $desc = $_POST['desc'];
                    mysql_query("INSERT INTO uploads (title, desc) VALUES ('$title', '$desc')");
                    echo $title;
                    echo $desc;
                }                  
            }
        }
    } else {
        echo "File is too big";
    }
} else {
   echo "Wrong file type";
}
}

I know that my file paths and form input are correct and if I echo the $title or $desc variables they return with the correct values. My problem is this: for some reason it won't enter the $title and $desc values into the database. The first mysql query works fine but not the second. Any idea why?

What's the output if you add echo mysql_error() after the second query? — Justin ᚅᚔᚈᚄᚒᚔ
– Justin ᚅᚔᚈᚄᚒᚔ, Commented Sep 28, 2011 at 19:08
yeah, it's a little screwed up right now but $name is for the actual file name, $title is for the user defined image name and $desc is for the user defined description. — codedude
– codedude, Commented Sep 28, 2011 at 19:09
First off, you really need to look at sanitizing data before you send it to the database, secondly what is the error that you are getting? — Marc Towler
– Marc Towler, Commented Sep 28, 2011 at 19:09
I'm not getting an errors just nothing is entered into the database — codedude
– codedude, Commented Sep 28, 2011 at 19:12

Michael Berkowski · Accepted Answer · 2011-09-28 19:07:41Z

2

This is likely because desc is a MySQL reserved keyword, and it must be enclosed in backquotes in your query statement. Always check mysql_error() to find the cause of a failed query.

$success = mysql_query("INSERT INTO uploads (title, `desc`) VALUES ('$title', '$desc')");
if (!$success) echo mysql_error();

Please also escape $title and $desc before insert, as they are coming directly from $_POST.

$title = mysql_real_escape_string($_POST['title']);
$desc = mysql_real_escape_string($_POST['desc']);

And do the same for $name in the earlier query:

$name = mysql_real_escape_string($_FILES["file"]["name"]);

answered Sep 28, 2011 at 19:07

Michael Berkowski

271k47 gold badges450 silver badges395 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

codedude Over a year ago

would this affect the $title variable too?

Michael Berkowski Over a year ago

@codedude No it wouldn't affect title because that isn't a MySQL reserved word. See the list I just linked into the answer.

Maxim Krizhanovsky · Accepted Answer · 2011-09-28 19:09:10Z

0

You are creating 2 records in the uploads table, for 1 file. Probably the name column is set to not null, and this causes second query not to work. It have to be:

$name = mysql_escape_string($_FILES["file"]["name"]);
$title = isset($_POST['title'])?mysql_escape_string($_POST['title']) : '';

$desc = isset($_POST['desc'])?mysql_escape_string($_POST['title']) : '';

mysql_query("INSERT INTO uploads (`name`, `title`, `desc`) VALUES ('$name', $title, $desc)");

answered Sep 28, 2011 at 19:09

Maxim Krizhanovsky

26.8k5 gold badges62 silver badges91 bronze badges

Collectives™ on Stack Overflow

PHP upload errors

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related