[RESOLVED] Uploaded File URI Database Insertion Problem

[inulled]

<form method="post" action="../processing/artist-adder.php">
<input placeholder="Artist Name" name="artist_name" type="text" /><br />
<br />
<input placeholder="Hometown" name="hometown" type="text" /><br />
<br />
<input placeholder="Artist Slogan" name="artist_slogan" type="text" /><br />
<br />
<input placeholder="Date Added" name="date_added" type="text" /><br />
<br />
<input name="picture" type="file" /><br />
<input name="upload" id="upload" type="submit" value="submit" />
<input name="Reset1" type="reset" value="reset" /></form>

<?php
if(isset($_POST['upload'])) {
$url = $_FILES['picture']['name']; 
$tmp_name = $_FILES['picture']['tmp_name']; 

$artist_name   = $_POST['artist_name'];
$hometown	   = $_POST['hometown'];
$artist_slogan = $_POST['artist_slogan'];
$date_added	   = $_POST['date_added'];

include("../processing/config.php");

mysql_query("INSERT INTO artists (ArtistName, Hometown, ArtistSlogan, AddedDate, Artist_IMG)
VALUES('$artist_name',$hometown','$artist_slogan','$date_added', '$url')");

mysql_close($connect);
}
?>

The Error:

Notice: Undefined index: picture in C:\Web Server\htdocs\Kevin's Site\processing\artist-adder.php on line 3

Notice: Undefined index: picture in C:\Web Server\htdocs\Kevin's Site\processing\artist-adder.php on line 4

Anybody got any clues as to whats going on?

[bradgrafelman]

Your form is missing the correct 'enctype' attribute; see this man page for more info: [man]features.file-upload.post-method[/man].

Also, you should be checking to make sure that the file upload succeeded before you attempt to use it.

Finally, note that if you don't move the uploaded file (e.g. with [man]move_uploaded_file/man) before the end of the script, it will simply be deleted (so your database will contain the location to a temp file that no longer exists).

[inulled]

I changed everything and now I'm getting this error:

Notice: Undefined variable: temp_name in C:\Web Server\htdocs\Kevin's Site\processing\artist-adder.php on line 6

This is very odd as my code seems to be correct:

<?php
if(isset($_POST['upload'])) {
$uploaddir = '../img';
$url = $uploaddir . basename($_FILES['picture']['name']);
$tmp_name = $_FILES['picture']['tmp_name'];
move_uploaded_file($tmp_name, "$url/$temp_name");

$artist_name   = $_POST['artist_name'];
$hometown	   = $_POST['hometown'];
$artist_slogan = $_POST['artist_slogan'];
$date_added	   = $_POST['date_added'];

include("../processing/config.php");

mysql_query("INSERT INTO artists (ArtistName, Hometown, ArtistSlogan, AddedDate, Artist_IMG)
VALUES('$artist_name',$hometown','$artist_slogan','$date_added', '$url')");

mysql_close($connect);
}
?>

And no its not uploading correctly.

[bradgrafelman]

There are several things wrong with your code, so here's an overall code critique:

1. $uploaddir = '../img'; 
   $url = $uploaddir . basename($_FILES['picture']['name']); 

   For one, what you're constructing is not a URL (which has nothing to do with the file system - only web requests). Second, if your file was named "filename" then look at what your path would be: "../imgfilename" - notice anything wrong?

2. $tmp_name = $_FILES['picture']['tmp_name']; 

   Why duplicate data by creating extra variables? Why not just reference $_FILES['picture']['tmp_name']?

3. move_uploaded_file($tmp_name, "$url/$temp_name"); [/code]Couple things wrong here. For one, $url appears to be the full path to the file, and yet you're also appending a '/' and the temporary file name. So if you uploaded a file called "foo.bar", then the path will look something like "../imgfoo.bar/AAAAAAA" (where 'AAAAAAA' is the randomly generated name of the temp file).

   Second:

   inulled;10983091 wrote:

   And no its not uploading correctly.

   How do you know? You still aren't checking this. Your code should only attempt to move the uploaded file (and/or likely use any information about the uploaded file at all) if PHP reports that it received the file successfully. As the PHP manual states (see link in my previous post), the 'error' index in the $_FILES array entry will contain the error code of the upload; you should be checking to see that this is equal to the constant UPLOAD_ERR_OK before attempting to process the file upload.

   If it isn't UPLOAD_ERR_OK, you might opt to log and/or display a relevant error message that explains why the upload was unsuccessful based on the error code.

4. Finally, note that your script is vulnerable to SQL injection attacks and/or just plain SQL errors. User-supplied data should never be placed directly into a SQL query; instead, it must first be sanitized with a function such as [man]mysql_real_escape_string/man (for string data) or, alternatively, use prepared statements.

[inulled]

So I managed to fix the problems you mentioned. Also, I'm not too worried about SQL injections at this point in the script. For one, it's used only be somebody with a superuser account. And I have the admin section on pretty good lockdown.

<?php
if(isset($_POST['upload'])) { 
$uploaddir = '../img/'; 
$url = $uploaddir . basename($_FILES['picture']['name']); 
move_uploaded_file($_FILES['picture']['tmp_name'], "$url"); 
print_r($_FILES);
$artist_name   = $_POST['artist_name']; 
$hometown       = $_POST['hometown']; 
$artist_slogan = $_POST['artist_slogan']; 
$date_added       = $_POST['date_added']; 

include("../processing/config.php"); 

mysql_query("INSERT INTO artists (ArtistName, Hometown, ArtistSlogan, AddedDate, Artist_IMG) 
VALUES('$artist_name',$hometown','$artist_slogan','$date_added', '$url')"); 

mysql_close($connect); 
} 
?>

One of the things I did in the script above was print-r'ed the $_FILES superglobal after the uploading process completed and I got the following errors with the following array:

Notice: Undefined index: picture in C:\Web Server\htdocs\Kevin's Site\processing\artist-adder.php on line 4

Notice: Undefined index: picture in C:\Web Server\htdocs\Kevin's Site\processing\artist-adder.php on line 5
Array ( [file] => Array ( [name] => 00_DJ_Messiah_and_Oj_Da_Juiceman_Still_Servin_Babies-Bootleg-2009-.jpg [type] => image/jpeg [tmp_name] => C:\Web Server\tmp\php6A8B.tmp [error] => 0 [size] => 85866 ) )

Now my knowaldge is a little sketchy in Arrays. So do you care to help me understand this code? My guess is the filesize and/or the filetype is wrong. But I could be completely wrong

[bradgrafelman]

inulled wrote:

Also, I'm not too worried about SQL injections at this point in the script.

That's a pretty bad attitude to have for a multitude of reasons. Plus, bad habits die hard.

And besides, a name such as O'Brien would break your script because you failed to sanitize input.

inulled wrote:

My guess is the filesize and/or the filetype is wrong.

Why would you guess that either of those has anything to do with the code you're using?

Besides, the error message spells it out: there is no such index called 'picture' in the $FILES array. As further proof, your print_r() shows the same; there is one index in the $FILES array and it isn't called "picture" (and the array index name will match the <input> HTML field's name).

[inulled]

So I just realized I had 'picture' as the html element name rather than 'file' So it uploads correctly, but the problem now is I can't seem to get the data to insert into MySQL. Below is the code:

artist_adder.php

<?php
if(isset($_POST['upload'])) { 
$uploaddir = '../img/'; 
$url = $uploaddir . basename($_FILES['file']['name']); 
move_uploaded_file($_FILES['file']['tmp_name'], "$url");

$artist_name 	= mysql_real_escape_string(strip_tags($_POST['artist_name']));
$hometown		= mysql_real_escape_string(strip_tags(sha1($_POST['hometown'])));
$artist_slogan  = mysql_real_escape_string(strip_tags($_POST['artist_slogan']));
$date_added 	= mysql_real_escape_string(strip_tags($_POST['date_added']));

include("../processing/config.php"); 

mysql_query("INSERT INTO artists (ArtistName, Hometown, ArtistSlogan, AddedDate, Artist_IMG) 
VALUES('$artist_name',$hometown','$artist_slogan','$date_added', '$url')") or die("ERROR"); 

mysql_close();
} 
?>

../processing/config.php

<?php
$db_host = "localhost";
$db_user = "root";
$db_pass = "";
$db_name = "kevo";

mysql_connect($db_host, $db_user, $db_pass) or die ("Couldn't Connect to Server");
mysql_select_db($db_name) or die ("Couldn't Select Database");
?>

And please do forgive me, even though I've been building with PHP for 3 years now, I don't have too much experience. Please yield a little patience for a newbie (:

[johanafm]

inulled;10983119 wrote:

mysql_query("INSERT INTO artists (ArtistName, Hometown, ArtistSlogan, AddedDate, Artist_IMG)
VALUES('$artist_name',$hometown','$artist_slogan','$date_added', '$url')") or die("ERROR");
[/code]

If the query failed stop program execution and display "ERROR"... This is a bad approach to handling failures.

$errors = array();

$result = mysql_query('...');
if (!$result)
{
	# Give yourself a chance to see what went wrong
	error_log(sprintf('%d: %s', mysql_errno(), mysql_error());

# and if you really want to abort program execution like before...
die('ERROR');

# But instead, you might want to keep track of errors and display them properly
# to the user.
$errors[] = 'Artist information could not be saved';
}
else 
{
	# proceed as usual
}

# and finally, when your code gets to the part where it outputs its contents
# (after menus etc)
foreach ($errors as $e)
{
	printf('<div class="error">%s</div>', $e);
}

[inulled]

Thanks you guys, everything seems to be working now (: