Insert statement not working: Posting to same page

bsewell

Hi,
I'm working on an image gallery as part of a CMS. I'm trying to submit the photos to the same page. What I have now is a printout of all the images in the table, followed by a button to upload files. I've tested it and there are no errors as far as I can see, but phpMyAdmin shows the insert didn't work. What's wrong?

Cheers,

	if ((isset($_POST['photo'])) && $_FILES['userfile']['size'] > 0)
	{
		$conn=mysql_connect($host,$username,$password) or die(mysql.error());
		mysql_select_db("$db_name")or die("cannot select DB");
		$uploadDate=date("d/m/y : H:i:s", time());

	$target_path = "../gallery/";
	$target_path = $target_path . basename( $_FILES['uploadedfile']['name']);
	$galleryId=$_POST['photoGallery'];

	if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path))
	{
		$sql="INSERT INTO tblphotogallery (galleryId,location,uploadDate,show) VALUES ('$galleryId','$target_path','$uploadDate','1')";
		mysql_query($sql) or die(mysql.error());
	}
}
?>
<h1>Elimu Website Admininistration - Image Gallery</h1>
<a href="gallery.php">Image Gallery</a>
<table bgcolor="#FFFF99">
<tr bgcolor="#FFFFCC"><td>Select</td><td>Name</td><td>Gallery</td><td>Upload Date</td></tr>
<?php
$conn=mysql_connect($host,$username,$password) or die(mysql.error());
mysql_select_db("$db_name")or die("cannot select DB");
$sql="SELECT * FROM tblphotogallery,tblgallery ORDER BY pictureId";
$result=mysql_query($sql);

$row=mysql_fetch_array($result);
while($row = mysql_fetch_array($result))
{?>
	<tr><td><?php echo $row['show']; ?></td><td><?php echo $row['name']; ?></td><td><?php echo $row['uploadDate']; ?></td></tr>
<?php	
}
?>
</table>
<h1>Upload Picture</h1>
<form enctype="multipart/form-data"  action="gallery.php" method="post">
<label for="photo">Select file:</label><input type="file" name="photo" />
<label for="photoGallery">Gallery:</label><select name="photoGallery">
<?php
$sql2="SELECT * FROM tblgallery ORDER BY galleryId";
$result2=mysql_query($sql2);
$row2=mysql_fetch_array($result);
while($row2 = mysql_fetch_array($result2))
{
	print '<option value="'.$row2['galleryId'].'">'.$row2['name'].'</option>';
}
?>
</select>
<input type="submit" value="Upload photo"/>
</form>

johanafm

Turn on error reporting. Thise code

mysql.error()

Should give "undefined constant" notice (unless it really is a constant), as well as fatal error "undefined function error()" (unless you have actually defined it yourself). And the correct code is most likely

mysql_error()

bsewell

I've changed that, and turned on error reporting for warnings and notices.

The error is: Notice: Undefined index: photo in C:\Program Files\Apache Software Foundation\Apache2.2\htdocs\elimu\admin\gallery.php on line 8

I've also checked my php.ini to check whether file uploads are on or not.

New updated code:

$file=$_POST["photo"];
if (isset($file))
	{
		echo "1";
		$conn=mysql_connect($host,$username,$password) or die(mysql_error());
		mysql_select_db("$db_name")or die("cannot select DB");
		$uploadDate=date("d/m/y : H:i:s", time());

	$target_path = "../gallery/";
	$target_path = $target_path . basename( $_FILES['photo']['name']);
	$galleryId=$_POST['photoGallery'];

	if(move_uploaded_file($_FILES['uploadedfile']['tmp_name'], $target_path))
	{
		$sql="INSERT INTO tblphotogallery (galleryId,location,uploadDate,show) VALUES ('$galleryId','$target_path','$uploadDate','1')";
		echo $sql;
		mysql_query($sql) or die(mysql_error());
	}
}

else
{
	echo "2";
}
?>
<h1>Elimu Website Admininistration - Image Gallery</h1>
<a href="gallery.php">Image Gallery</a>
<table bgcolor="#FFFF99">
<tr bgcolor="#FFFFCC"><td>Select</td><td>Name</td><td>Gallery</td><td>Upload Date</td></tr>
<?php
$conn=mysql_connect($host,$username,$password) or die(mysql.error());
mysql_select_db("$db_name")or die("cannot select DB");
$sql="SELECT * FROM tblphotogallery,tblgallery ORDER BY pictureId";
$result=mysql_query($sql);

$row=mysql_fetch_array($result);
while($row = mysql_fetch_array($result))
{?>
	<tr><td><?php echo $row['show']; ?></td><td><?php echo $row['name']; ?></td><td><?php echo $row['uploadDate']; ?></td></tr>
<?php	
}
?>
</table>
<h1>Upload Picture</h1>
<form enctype="multipart/form-data"  action="gallery.php" method="post">
<input type="hidden" name="MAX_FILE_SIZE" value="10000000" />
<label for="photo">Select file:</label><input type="file" name="photo" />
<label for="photoGallery">Gallery:</label><select name="photoGallery">
<?php
$sql2="SELECT * FROM tblgallery ORDER BY galleryId";
$result2=mysql_query($sql2);
$row2=mysql_fetch_array($result);
while($row2 = mysql_fetch_array($result2))
{
	print '<option value="'.$row2['galleryId'].'">'.$row2['name'].'</option>';
}
?>
</select>
<input type="submit" value="Upload photo"/>
</form>

bradgrafelman

Couple of issues I see after briefly scanning your code:

You define a variable, and then use [man]isset/man after doing so - doesn't make much sense. In addition, you reference a $POST element without verifying that it exists first. You should use [man]isset/man on the $POST item itself, rather than trying to assign its value to a variable.
There won't be an item called $POST['photo'] since the 'photo' element in the form is a <input type="file"> element - those form fields are processed using the $FILES array instead.
Your code references $_FILES['uploadedfile'] in the second if() statement, yet there is no such form field called 'uploadedfile' in the HTML.
You should never place user-supplied data directly into a SQL query string, else your code will be vulnerable to SQL injection attacks and/or just plain SQL errors. Instead, you must first sanitize the data with a function such as [man]mysql_real_escape_string/man (for string data).

Also, when posting PHP code, please use the board's [noparse]

..

[/noparse] bbcode tags (not the generic CODE tags) as they make your code much easier to read and analyze.

EDIT: Oops - ignore the above statement, failed to notice that the beginning of the code snippet lacked a '<?php' thus throwing off the board's syntax highlighting.