[RESOLVED] filename instead of new_id

[kmoser82]

I am reuseing code but with this site I do not want to generate a number for the filename i want to use the same filename. Can anyone help me fix the code.

mysql_query( "INSERT INTO gallery_photos(`photo_filename`, `photo_caption`, `photo_category`) VALUES('0', '".addslashes($photo_caption[$counter])."', '".addslashes($_POST['category'])."')" );
				$new_id = mysql_insert_id();
				$filetype = $photos_uploaded['type'][$counter];
				$extention = $known_photo_types[$filetype];
				$filename = $new_id.".".$extention;

			mysql_query( "UPDATE gallery_photos SET photo_filename='".addslashes($filename)."' WHERE photo_id='".addslashes($new_id)."'" );

			// Store the orignal file
			copy($photos_uploaded['tmp_name'][$counter], $images_dir."/".$filename);

[samuelcook]

$filename = $new_id.".".$extention;

could be changed to

$filename = $photos_uploaded['name'][$counter].".".$extention;

[kmoser82]

Thanks for the quick feedback. I works!

[bradgrafelman]

Also note that [man]addslashes/man should never be used to prepare data for a SQL query; instead, you should be using a DBMS-specific escaping mechanism such as [man]mysql_real_escape_string/man (for string data - using this for numeric data isn't appropriate {nor is addslashes(), I might add}).