Help Needed, please ease my frustration

mr-moobs

Hi all, I'm new to PHP and have been trying for the last 4 hours to get a script working. A thumbnail appears in the upload.php page, but nothing is registering in the table.

If anyone can help I would appreciate it so much, it will stop my laptop from flying out the window.

here is my code for the upload form

<?php 

include 'dbc.php';
page_protect();

$_SESSION['id_user'] = $_POST['id_user'];
$_SESSION['firsttime']= "ok";
?>

<style type="text/css">
<!--
.style2 {font-size: 36px}
-->
</style>
<body bgcolor="#FF6699">
<div align="center">
  <p><br />
</p>
  <p><br />
    <br />
    </p>
</div>
<center>
<p>Choose the image you want to upload, The image must be less than 100 kb in size.</p>
<form action="upload.php"  enctype="multipart/form-data" method="POST">
<input name="id_user" type="hidden" value="<?php echo $_SESSION['id_user']; ?>" />
  <table width="95%" border="0">
  <tr>
    <td>Select a file:</td>
    <td><input type="file" name="user_file" size="50"></td>
  </tr>
  <tr>
    <td>Title</td>
    <td><input name="title" type="text" id="title" size="40"/></td>
  </tr>
  <tr>
    <td>Description</td>
    <td><textarea name="description" cols="40" rows="4" id="description"></textarea></td>
  </tr>
  <tr>
    <td>Tags</td>
    <td><input name="image_tags" type="text" id="image_tags" size="40"/> 
      (seperate tags by comma) </td>
  </tr>
  <tr>
    <td>&nbsp;</td>
    <td><input type="submit" name="submit" value="Upload Now" /></td>
  </tr>
</table>
<p><br />

  <br />
</p>
</form>
<br><h2><a href='library.php'>View Images Library</a></h2>
</center>

and this is the code to process the upload

<?php 

include 'dbc.php';
page_protect();

$_SESSION['id_user'] = $_POST['id_user'];

$n=$_FILES['user_file']['name'];
$type=$_FILES['user_file']['type'];
$size=$_FILES['user_file']['size'];
$time=time();
$n=$time;
$path="uploads\\". $n;




$uploaded = $_SESSION['firsttime'];

if ($uploaded== 'ok')
{
       if ($size<100000 && preg_match("/image/", $type) )
          {
				move_uploaded_file($_FILES['user_file']['tmp_name'],
				$path);

			$path2=$root . $n;
			echo "<center>";
			echo "<h3>Your Image Link Is: </h3><a href=$path2>$path2</a><br><br>"; 
			echo "<br>";
			echo "<img src=$path2 border='5' height='100' width='100'></img>";
			echo "<center>";

			$link=mysql_connect("localhost", "heritage1", "heritage1")
			or die("couldn't connect to database");
			mysql_select_db("heritage1") or die("Could not select database");
			$query = "INSERT INTO image_table (image, title, description, image_tags) VALUES ('$path2', '$_POST[title]', '$_POST[description]', '$_POST[image_tags]')";
			$result = mysql_query($query);
			echo "1 record added";
			//session_destroy();
      }
}	  

else
{
echo "you couldnt upload the same image many times per session go back and choose it or another one";
}


////////////
     if ($size>1000000)
       {
echo "ERROR <br> the image size is too big<br>";
       }

 if (!preg_match("/image/",$type) )
  {
echo "ERROR <br> the file is not image<br>";
       }


echo"<br><br><h2><a href='library.php'>View Images Library</a></h2>";
echo "<body bgcolor='#FF6699'>";


?>

bradgrafelman

Couple things related to your problem:

User-supplied data should never be placed directly into a SQL query string. Instead, it must first be sanitized with a function such as [man]mysql_real_escape_string/man (for string data). Otherwise, your code is vulnerable to SQL injection attacks and/or just plain SQL errors.
When debugging a SQL problem, it's best to get as much information as possible from the SQL server. For example, I'll commonly debug suspected SQL errors like this:
```
$query = "SELECT foo FROM bar..."; // store query string in a variable
$exec = mysql_query($query) or die("MySQL error: " . mysql_error() . "<br>\nQuery: $query");
```
That way, if the query fails, you'll not only see the error message returned by the SQL server but you'll also get a chance to visually inspect the query that was sent.

Few other issues you should also know about:

Not sure what's in "dbc.php" or what your "page_protect()" function does, but make sure you're calling [man]session_start/man on every page where you either read or write session data.
Why are you putting the id_user in a hidden form element as well as storing it in the session? Putting it in the form (even as a hidden element) allows the user to easily manipulate the value. If it's stored in the session, then just use that value - there's no need to constantly add it to a form and then read back the same value on the next page.

Just a matter of preference, but is there any reason you use 3 lines:

    $time=time(); 
    $n=$time; 
    $path="uploads\\". $n;

where just 1 will do:

$path = "uploads\\" . time();

```
preg_match("/image/", $type)
```
You should never trust the 'type' supplied in the $_FILES array. As the manual states, this data is taken from the client and is not guaranteed to be accurate. If you want to ensure you've got a valid image, use something like [man]getimagesize/man to see if you get valid data back (e.g. the function doesn't return FALSE).

As it stands now, I could upload a .exe or .php file and your script would accept it.
You should ensure that you're using valid HTML syntax (which you aren't).
Again, this might be more of a matter of preference and/or best coding practices, but I always recommend using [man]isset/man or [man]empty/man to verify that external data exists before you attempt to access it (even in an if() statement).