[RESOLVED] upload file problem

vang

Hi,

i'm having problem with file uploading for the past 3 days.

I have 3 files:
a) table listing of db records
b) add record.php
c) edit record.php

the "file uploading" is doing fine in file (b), but i'm having problem when i try to do it in file (c).

Appreciate if you could show me where i have done wrong, many thanks.

tables:
a) project
b) parts
c) fileupload

<?php
........

if (isset($_POST['submit']))
{	$projectid	= $_POST['element_5'];
	$partsid	= $_POST['element_6'];
	$drawing	= $_POST['element_3'];
	$remove	= $_POST['remove'];

$partnumber	= strtoupper($_POST['element_1']);
$partname	= strtoupper($_POST['element_2']);

if ($remove == 'deletedrawing') 
{	$sql2 = "DELETE FROM fileupload WHERE partsid='$partsid'";
	$res2 = mysql_query($sql2);

	$sql3 = "UPDATE parts
		   SET partnumber ='$partnumber',
			 partname   ='$partname',
			 drawing    =''
		   WHERE id='$partsid'";
	$res3 = mysql_query($sql3);

	header("Location:project_details.php?projectid=$projectid");
}

if ($drawing)
{	$sql4 = "UPDATE parts
		   SET partnumber	= '$partnumber',
			 partname	= '$partname',
			 drawing	= '$drawing'
		   WHERE id='$partsid'";

	$res4 = mysql_query($sql4);

	header("Location:project_details.php?projectid=$projectid");
}

if ($_FILES['element_4']['size'] >  0)
{	$fileName = $_FILES['element_4']['name'];
	$tmpName  = $_FILES['element_4']['tmp_name'];
	$fileType = $_FILES['element_4']['type'];
	$fileSize = $_FILES['element_4']['size'];

	$fp	    = fopen($tmpName, 'r');
	$content  = fread($fp, filesize($tmpName));
	$content  = addslashes($content);
	fclose($fp);

	$sql4 = "INSERT INTO fileupload (partsid, filename, filesize, filetype, filecontent)
		  VALUES ('$partsid', '$fileName', '$fileSize', '$fileType', '$content')";

	$res4 = mysql_query($sql4) or die('Error, query failed');

	$sql5 = "UPDATE parts
		   SET partnumber ='$partnumber',
			 partname   ='$partname',
			 drawing    ='$fileName'
		   WHERE id='$partsid'";

	$res5 = mysql_query($sql5);

	header("Location:project_details.php?projectid=$projectid");
}
else
{	$sql6 = "UPDATE parts
		   SET partnumber ='$partnumber',
			 partname   ='$partname',
		   WHERE id='$partsid'";

	$res6 = mysql_query($sql6);

	header("Location:project_details.php?projectid=$projectid");
}
}
else
{	$projectid = $_GET['projectid'];
	$partsid   = $_GET['partsid'];

$sql = "SELECT * FROM parts WHERE id='$partsid'";
$res = mysql_query($sql);
$row = mysql_fetch_array($res);

$partnumber	= $row['partnumber'];
$partname	= $row['partname'];
$drawing	= $row['drawing'];
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
 <head>
  <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
  <title>Edit Parts</title>
  <link rel="stylesheet" type="text/css" href="js/view.css" media="all">
  <script type="text/javascript" src="js/view.js"></script>
 </head>
 <body id="main_body" >
  <img id="top" src="js/top.png" alt="">
  <div id="form_container">
   <h1><a></a></h1>
   <form id="partseditform" name="partseditform" class="appnitro" method="post" action="<?php echo $_SERVER['PHP_SELF'] ?>">
    <div class="form_description">
     <h2>Edit Parts</h2><p></p>
    </div>						
    <ul>
	<input id="element_5" name="element_5" type="hidden" value="<?php echo $projectid	?>" readonly/>
	<input id="element_6" name="element_6" type="hidden" value="<?php echo $partsid	?>" readonly/>
     <li id="li_1" >
      <label class="description" for="element_1">Part Number </label>
      <div><input id="element_1" name="element_1" class="element text medium" type="text" maxlength="255" value="<?php echo $partnumber	?>"/></div> 
     </li>
     <li id="li_2" >
      <label class="description" for="element_2">Part Name </label>
      <div><input id="element_2" name="element_2" class="element text medium" type="text" maxlength="255" value="<?php echo $partname ?>"/></div> 
     </li>
     <li id="li_3" >
      <div>
	<?php
	if ($drawing)
	{
	?>
	 <label class="description">Drawing </label>
	 <input id="element_3" name="element_3" type="text" size="44" value="<?php echo $drawing ?>" readonly />
	 <input id="remove" name="remove" type="checkbox" value="deletedrawing" /> delete drawing<p>
	<?php
	}
	else
	{
	?>
	 <label class="description" for="element_4">Upload Drawing </label>
	 <input type="hidden" name="MAX_FILE_SIZE" value="2000000">
	 <input id="element_4" name="element_4" class="element text medium" type="file">
	<?php
	}
	?>
	</div>
     </li>
     <li class="buttons">
      <input id="submit" class="button_text" type="submit" name="submit" value="Update" />
     </li>
    </ul>
   </form>
   <div id="footer"></div>
  </div>
  <img id="bottom" src="js/bottom.png" alt="">
 </body>
</html>

bradgrafelman

Not sure I understand what your problem is and what part of the code you posted deals with this problem.

One thing I did notice is that this:

        $fp        = fopen($tmpName, 'r'); 
        $content  = fread($fp, filesize($tmpName)); 
        $content  = addslashes($content); 
        fclose($fp);

could potentially cause problems. For one, you aren't opening the file in binary mode, and for another, you should never use [man]addslashes/man to prepare data for a DB query (unless you have absolutely no other choice, which is unlikely). For the 'mysql' PHP extension, you should be using [man]mysql_real_escape_string/man.

Also, you should be opening/reading the file in 'binary' mode to prevent automatic line ending translation. Then again, [man]file_get_contents/man is binary safe and would result in much more compact code, e.g.:

$content = mysql_real_escape_string( file_get_contents($tmpName) );

vang

many thanks for your guidance.

i was testing out this tutorial when i got into problem.

i used the code on 2 php file
a) add record.php (works fine even with your modifications!)
b) edit record.php (having problems)

tables:

CREATE TABLE `project` (
`projectid` BIGINT(20) unsigned NOT NULL auto_increment,
`projectno` varchar(15) NOT NULL,
PRIMARY KEY (`projectid`),
UNIQUE KEY `projectno` (`projectno`)
) TYPE=MyISAM DEFAULT CHARSET=latin1;

CREATE TABLE `parts` (
`id` BIGINT(20) unsigned NOT NULL auto_increment,
`projectno` varchar(15) NOT NULL,
`partnumber` varchar(25) NOT NULL,
`partname` varchar(50) NOT NULL,
`drawing` varchar(50) NOT NULL,
PRIMARY KEY (`id`)
) TYPE=MyISAM DEFAULT CHARSET=latin1;

CREATE TABLE `fileupload` (
`fileid` BIGINT(20) unsigned NOT NULL auto_increment,
`partsid` BIGINT(20) unsigned NOT NULL,
`filename` VARCHAR(30) NOT NULL,
`filetype` VARCHAR(30) NOT NULL,
`filesize` INT NOT NULL,
`filecontent` MEDIUMBLOB NOT NULL,
PRIMARY KEY (`fileid`)
) TYPE=MyISAM DEFAULT CHARSET=latin1;

i'm having problems with edit record.php.

1) cannot upload file
when i add a new record (with data like part name or part number but no drawing). i try to add the drawing at later stage(edit record.php) but failed.
it seems that i can only add drawing only during the initial add record stage.
Can you see the problem?

2) edited fields not reflected correctly in db (logic problem i guess)

Many thanks for your guidance.

vang

i've managed to solve the logic part, only left with the file uploading issue, any advise is appreciated, thanks.

if (isset($_POST['submit']))
{	$projectid	= $_POST['element_5'];
	$partsid	= $_POST['element_6'];
	$drawing	= $_POST['element_3'];
	$remove	= $_POST['remove'];

$partnumber	= strtoupper($_POST['element_1']);
$partname	= strtoupper($_POST['element_2']);

if ($remove == 'deletedrawing') 
{	$sql2 = "DELETE FROM fileupload WHERE partsid='$partsid'";
	$res2 = mysql_query($sql2) or die('Error, query failed');
	$drawing ='';
}

$fileName = $_FILES['element_4']['name'];
$tmpName  = $_FILES['element_4']['tmp_name'];
$fileType = $_FILES['element_4']['type'];
$fileSize = $_FILES['element_4']['size'];

if ($fileSize > 0)
{	$content = mysql_real_escape_string(file_get_contents($tmpName));

	$sql3 = "INSERT INTO fileupload (partsid, filename, filesize, filetype, filecontent)
		  VALUES ('$partsid', '$fileName', '$fileSize', '$fileType', '$content')";

	$res3 = mysql_query($sql3) or die('Error, query failed');

	$drawing = $fileName;
}

$sql4 = "UPDATE parts
	   SET partnumber ='$partnumber',
		 partname   ='$partname',
		 drawing    ='$drawing'
	   WHERE id='$partsid'";

$res4 = mysql_query($sql4);

header("Location:project_details.php?projectid=$projectid");
}
else
{	$projectid = $_GET['projectid'];
	$partsid   = $_GET['partsid'];

$sql = "SELECT * FROM parts WHERE id='$partsid'";
$res = mysql_query($sql);
$row = mysql_fetch_array($res);

$partnumber	= $row['partnumber'];
$partname	= $row['partname'];
$drawing	= $row['drawing'];
}
......

vang

It is not working properly but now i managed to add some data into the table, eg. file size =0.

It seems to me that it is not reading any file at all even though i have selected the whole file to be upload.

I do not know why it always give an empty value to $fileName. Any advise?

if (isset($_POST['submit']))
{	$projectid	= $_POST['element_5'];
	$partsid	= $_POST['element_6'];
	$drawing	= $_POST['element_3'];
	$remove	= $_POST['remove'];

$partnumber	= strtoupper($_POST['element_1']);
$partname	= strtoupper($_POST['element_2']);

if ($remove == 'deletedrawing') 
{	$sql2 = "DELETE FROM fileupload WHERE partsid='$partsid'";
	$res2 = mysql_query($sql2) or die('Error, query failed');
	$drawing ='';
}

$fileName = $_FILES['element4']['name'];
$tmpName  = $_FILES['element4']['tmp_name'];
$fileSize = $_FILES['element4']['size'];
$fileType = $_FILES['element4']['type'];

$content = mysql_real_escape_string(file_get_contents($tmpName));

$sql3 = "INSERT INTO fileupload (partsid, filename, filetype, filesize, filecontent)
	  VALUES ('$partsid', '$fileName', '$fileType', '$fileSize', '$content')";

$res3 = mysql_query($sql3) or die('Error, query failed');

if ($fileSize > 0)
{	$drawing = $fileName;
}

$sql4 = "UPDATE parts
	   SET partnumber ='$partnumber',
		 partname   ='$partname',
		 drawing    ='$drawing'
	   WHERE id='$partsid'";

$res4 = mysql_query($sql4);

header("Location:project_details.php?projectid=$projectid");
}
else
{	$projectid = $_GET['projectid'];
	$partsid   = $_GET['partsid'];

$sql = "SELECT * FROM parts WHERE id='$partsid'";
$res = mysql_query($sql);
$row = mysql_fetch_array($res);

$partnumber	= $row['partnumber'];
$partname	= $row['partname'];
$drawing	= $row['drawing'];
}
?>

bradgrafelman

I see nothing in that code that first verifies whether the file upload even succeeded. Check $_FILES['element4']['error'] to make sure that no error occured (or, if one did, log it (or output it for now) so you can debug the problem).

Also note that the 'type' index is a user-supplied value and can not be trusted (I could upload a .exe file and call it 'image/jpeg').

vang

hi,
i've solved my problem. i missed out this at the form declaration:

enctype="multipart/form-data"

and it took me 3 days to find it!

many thanks for your advice 🙂