[RESOLVED] Cant get stuff to goto database

[msnhockey]

I'm helping a friend trying to get his stuff to post the info to the database.

this is a online form submission that allows a user to upload a pic as well. the pic does goto the correct folder just nothing uploads to the database.

It does find the database because if we change something in the settings it says unable to connect to database

here is some of the code that we have been messing around with

$post = isset($_GET['post'])?$_GET['post']:"";

if ($post == "yes") {

extract($_POST);

	$fname = $_POST['fname'];
	$lname= $_POST['lname'];
	$address = $_POST['address'];
	$city = $_POST['city'];
	$state = $_POST['state'];
	$zip = $_POST['zip'];
	$phone = $_POST['phone'];
	$attending = $_POST['attending'];
	$email = $_POST['email'];
	$NEW_PHOTO = $_POST['NEW_PHOTO'];



$sql = "INSERT INTO articles SET fname='$fname', lname='$lname', address= '$address', city ='$city', state='$state', zip= '$zip', phone= '$phone', attending= '$attending', email= '$email', NEW_PHOTO= '$UPLOADED_PHOTO' ";
        $done = mysql_query($sql);
        if(!$done) {$html = mysql_errno().": ".mysql_error()."<br>";}

return $html;

if ($sql_debug_mode==1) { echo "<BR>SQL: $sql<BR>"; } 
$error_msg = mysql_query($sql,db());

any help or ideas is appriciated

thanks

[bradgrafelman]

For one, get rid of this:

extract($_POST);

For another, sanitize the external data before placing it in the SQL query string.

As for the actual problem... what is [man]mysql_query/man returning? (Hint: [man]var_dump/man is a good way to figure out the exact contents of a variable.)

Have you tried echo'ing out the SQL query string and visually inspecting it to see if it looks correct? Have you then tried copying-and-pasting it into something like phpMyAdmin or the MySQL CLI and manually executing the query yourself?

[msnhockey]

thanks for advice I removed the extract($_POST) and then i found a mis spelling of one of the words for the database column..

I was getting unable to insert into database and now everything worrks fine except for validation. it inserts the form wether its filled out correctly or not

[bradgrafelman]

msnhockey;10985438 wrote:

everything worrks fine except for validation.

Er... what validation? There isn't any in the code snippet you posted above.

[msnhockey]

whoops.. i will post the code i have now.

<?php
//db info was here
$post = isset($_GET['post'])?$_GET['post']:"";

if ($post == "yes") {


$UPLOADED_PHOTO = $_FILES['NEW_PHOTO']['name']; 


$sql = "INSERT INTO robert (
id,fname,lname,address,city,state,zip,phone,attending,email,NEW_PHOTO $addl_insert_crit ) VALUES ( '$id',
'$fname','$lname','$address','$city','$state','$zip','$phone','$attending','$email','$UPLOADED_PHOTO' $addl_insert_values )";
	if ($sql_debug_mode==1) { echo "<BR>SQL: $sql<BR>"; } 
	$result = mysql_query($sql,db());



$error_msg=array(); 

if ($fname == ''){
	$error_msg[]="Please enter your First name";
}

if(!preg_match('/^\b[a-zA-Z]+\b$/', $fname)){
	$error_msg[]="First Name can only contain letters";
}


if ($lname == ''){
	$error_msg[]="Please enter your last name";
}

if(!preg_match('/^\b[a-zA-Z]+\b$/', $lname)){
	$error_msg[]="Last Name can only contain letters";
}

if ($address == ''){
	$error_msg[]="Please enter your address";
}

if(!preg_match('/^[a-z0-9 ]*$/i', $address)){
	$error_msg[]="Address can only contain numbers, letters and spaces";
}


if ($city == ''){
	$error_msg[]="Please enter your city";
}

if (!preg_match('/^\b[a-zA-Z ]+\b$/', $city)){
	$error_msg[]="City can only contain letters";
}

if ($state == ''){
	$error_msg[]="Please enter your state";
}

if (strlen($state)<>2){
	$error_msg[]="State can only contain 2 letters; use state abbreviation";
}

if (!preg_match("/^\b[a-zA-Z]+\b$/", $state)){
	$error_msg[]="State can only contain letters";
}

if ($zip == ''){
	$error_msg[]="Please enter your zip code";
}

if (strlen($zip)<>5){
	$error_msg[]="Zip code can only contain 5 digits";
}

if(!is_numeric($zip)){
	$error_msg[]="Zip code must contain only numbers";
}

if ($phone == ''){
	$error_msg[]="Please enter your phone number";
}

if (strlen($phone)<>10){
	$error_msg[]="Phone number can only contain 10 digits";
}

if(!is_numeric($phone)){
	$error_msg[]="Phone number must contain only numbers";
}

if ($attending == ''){
	$error_msg[]="Please enter if you plan to attend";
}


if ($email == ''){
	$error_msg[]="Please enter your e-mail address";
}






if ($error_msg){
	$display_errors =  "
<table background='http://ufhl.theufhl.com/images/images/signupbk1.gif' width='640' height='560'> 
<td valign='top' align='center'>
<table border='0' width='600' cellspacing='0' cellpadding='0'>
<tr><td height='66'></td></tr>	
<TR>
<td width='25' height='30'></td>
<TD class=table_header>
<h3>There were errors in your submission.</h3>
		<p>Please review the following errors, press the Back button on your browser, and make corrections before re-submitting.</p>
		<ul style=color:red>\n";
			foreach ($error_msg as $err){
				$display_errors .= "<li>".$err."</li>\n";
			}
		$display_errors .= "</ul>\n

<p class=header align=center>GO <a href='javascript:history.go(-1)'><u>BACK</u></a> AND TRY AGAIN.</p>  





 </td></tr></td>
</table></table>";

}

if (!$error_msg){

echo "<table background='http://ufhl.theufhl.com/images/images/signupbk1.gif' width='640' height='560'> 
<td valign='top' align='center'>
<table border='0' width='600' cellspacing='0' cellpadding='0'>
<tr><td height='66'></td></tr>	
<TR>
<td width='25' height='30'></td>
<TD class=table_header>Thank you <font color='red'>$fname $lname </font>for completing the online RSVP form for the company's Christmas party. <br><br> Below you will find the details of the form you submitted. You will also be sent an e-mail with the information you provided and details of the Christmas party.
<br><br>
<b>Name:</b> $fname $lname<br>
<b>Address:</b> $address<br>
<b>City:</b> $city<br>
<b>State:</b> $state <b>Zip Code:</b> $zip<br><br>
<b>Phone:</b> $phone<br><br>
<b>Is Attending:</b> $attending<br><br>
<b>Photo:</b><br>
<img src='http://www.theufhl.com/images/news/thumb/". $_FILES["NEW_PHOTO"]["name"] ."'><br>
<a href='http://www.theufhl.com/images/news/". $_FILES["NEW_PHOTO"]["name"] ."'>". $_FILES["NEW_PHOTO"]["name"] ."</a>

  </td></tr></td></table></table>";



$to = "[e-mail]";
$subject = "XMAS RSVP for ($fname $lname)";
$body = "This is a Message to let you know that $fname $lname has completed the online RSVP company Christmas form.

Here are the details that $fname $lname has provided.

Name: $fname $lname
Address: $address
City: $city
State: $state  Zip Code: $zip

Phone: $phone

Is Attending: $attending

Photo: http://www.theufhl.com/images/news/". $_FILES["NEW_PHOTO"]["name"] ."

";
if (mail($to, $subject, $body)) {

 }

$to1 = "$email";
$subject1 = "Jeppson Enterprise Christmas Party";
$body1 = "Hi $fname,

Below you will find details of the christmas party and details of the information you submitted on the online RSVP form

Jeppson Enterprise Christmas Party
WHEN: December 21,2011
TIME: ****tails start at 5:30, dinner at 6:30 and dance to follow
WHERE:Salt Lake City Convention Center
      10211 Salt Lake Blvd
      Salt Lake City
      23872


Below you will find details of what you submitted

Name: $fname $lname
Address: $address
City: $city
State: $state  Zip Code:$zip

Phone: $phone

Is Attending: $attending

Photo: http://www.theufhl.com/images/news/". $_FILES["NEW_PHOTO"]["name"] ."
";
if (mail($to1, $subject1, $body1)) {

 }



} 

echo $display_errors;

} 




if (!$post) {

?>
	<form method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>?proc=New&post=yes" enctype="multipart/form-data">
	<center>
<body topmargin='0' leftmargin='0' rightmargin='0' bottommargin='0'>

 <div align='center'>
	<table background='http://ufhl.theufhl.com/images/images/signupbk1.gif' width='640' height='560'>
		<tr>
	<td valign='top' align='center'>
	<table border='0' width='340' cellspacing='0' cellpadding='0'>

<tr><td height='66'></td></tr>	
<tr><td></td></tr>

<tr>
<td width='25' height='30'></td>
<td></td>
<td class='table_text' colspan='2'>
<input class='table_text' type='hidden' name='id'>
</td>
</tr>	


<tr>
<td width='25' height='30'></td>
<td bgcolor='#dfdfdf' class='table_header'>First Name:</td>
<td bgcolor='#dfdfdf' class='table_text' colspan='2'>
<input class='table_text' type='text' name='fname'>
</td>
</tr>		

<tr>
<td width='25' height='30'></td>
<td class='table_header'>Last Name:</td>
<td class='table_text' colspan='2'>
<input class='table_text' type='text' name='lname'>
</td>
</tr>

<tr>
<td width='25' height='30'></td>
<td class='table_header' bgcolor='#dfdfdf'>Address:</td>
<td class='table_text' bgcolor='#dfdfdf'>
<input class='table_text' type='text' name='address'>
</td>
</tr>

<tr>
<td width='25' height='30'></td>
<td class='table_header'>City:</td>
<td class='table_text'>
<input class='table_text' type='text' name='city'>
</td>
</tr>

<tr>
<td width='25' height='30'></td>
<td class='table_header' bgcolor='#dfdfdf'>State:</td>
<td class='table_text' bgcolor='#dfdfdf'>
<input class='table_text' type='text' name='state'>
</td>
</tr>

<tr>
<td width='25' height='30'></td>
<td class='table_header'>Zip Code:</td>
<td class='table_text'>
<input class='table_text' type='text' name='zip'>
</td>
</tr>

<tr>
<td width='25' height='30'></td>
<td class='table_header' bgcolor='#dfdfdf'>Phone:</td>
<td class='table_text' bgcolor='#dfdfdf'>
<input class='table_text' type='text' name='phone'>
</td>
</tr>

<tr>
<td width='25' height='30'></td>
<td class='table_header'>Attending:</td>
				<td class='table_text'>
				<select name='attending' class='table_text' style='width:78%'>
				<option value=' '></option>
				<option value='Yes'>Yes</option>
				<option value='No'>No</option>
                                </select>

</td>
</tr>

<tr>
<td width='25' height='30'></td>
<td class='table_header' bgcolor='#dfdfdf'>E-Mail:</td>
<td class='table_text' bgcolor='#dfdfdf'>
<input class='table_text' type='text' name='email'>
</td>
</tr>

<tr>
<td width='25' height='30'></td>
<td class='table_header'>PHOTO:</td>
<td class='table_text'>
<input type='file' name='NEW_PHOTO' class='table_text'>
</td>
</tr>

<TR>
<TD>
</TD>
<TD>
</TD>

<TD>
<INPUT TYPE="SUBMIT" VALUE="Register" NAME="submit">
<INPUT TYPE="RESET" VALUE="Reset" NAME="reset">


</TD>
</TR>


</TABLE>
</CENTER>
<BR>
</FORM>

<?php
} //END if post=""

$uploaddir = "./images/news/"; 
$uploadthumb = "./images/news/thumb/"; 
include('./includes/SimpleImage.php');
include('./includes/function.php');
$uploadfile = $uploaddir . basename($_FILES['NEW_PHOTO']['name']);
$uploadthumbfile = $uploadthumb . basename($_FILES['NEW_PHOTO']['name']);

if (move_uploaded_file($_FILES['NEW_PHOTO']['tmp_name'], $uploadfile)) { 

$image = new SimpleImage();
$image->load($uploadfile); 
$image->resize(480,400); 
$image->save($uploadfile); 
$UPLOADED_PHOTO = basename($_FILES['NEW_PHOTO']['name']);
$thumb = new SimpleImage(); 
$thumb->load($uploadfile); 
$thumb->resize(110,75); 
$thumb->save($uploadthumbfile); 
}else{ 
$UPLOADED_PHOTO = $_POST['PHOTO']; 
}

?>

[bradgrafelman]

For one, what happened to these lines:

		$fname = $_POST['fname'];
		$lname= $_POST['lname'];
		$address = $_POST['address'];
		$city = $_POST['city'];
		$state = $_POST['state'];
		$zip = $_POST['zip'];
		$phone = $_POST['phone'];
		$attending = $_POST['attending'];
		$email = $_POST['email'];

? Since you got rid of them, all of those variables are now undefined (thus you're going to be INSERT'ing a lot of empty strings rather than the POST'ed data).

For another, why are you executing the INSERT query before any of the validation is ever performed, rather than after and if no errors were found (e.g. the if() branch were you send the e-mails and whatnot)?

[msnhockey]

once i got it to work i figured i didnt need this

        $fname = $_POST['fname'];
        $lname= $_POST['lname'];
        $address = $_POST['address'];
        $city = $_POST['city'];
        $state = $_POST['state'];
        $zip = $_POST['zip'];
        $phone = $_POST['phone'];
        $attending = $_POST['attending'];
        $email = $_POST['email']; 

can i put this back in with what i have now??

also with the INSERT should it be after the if() branch??

thanks for reply

[bradgrafelman]

If it's working without ever defining those variables, then you need to get the (highly) deprecated register_globals directive disabled.

msnhockey wrote:

also with the INSERT should it be after the if() branch??

It should be wherever it logically makes sense.

[msnhockey]

i checked my php file.. im using php 5 and register globals is off.

I will add them back in and try moving the INSERT around and see what happens.

[msnhockey]

i added in those $_POST variables and been moving the INSERT stuff around but it still inserts.. gonna have to do some more reading on form validation to see where i need to put it

[leatherback]

Hi Mike:

// First you get the variables defined;
  // Note that you should not just insert the data to the database without cleaning a bit
  // If you have no idea what shuold be in the data, use e.g., mysql_real_escape_string
  // If you do not know why you do this, read about (my)sql inject

$fname = mysql_real_escape_string($_POST['fname']); 

// Second: test whether the data is all set
$error_msg=array(); 

if ($fname == ''){
	$error_msg[]="Please enter your First name";
}

   // etc

}


// Third: Check whether there were errors

if(count($error_msg == 0))
  {
  // No errors found:

  // 3a Insert the data

  // 3b If succesfull insert, show the user the positive outcome info

  // 3c If no successfull insert, show the form with data & an error message
  }
else
  {
  // data were not correct; Provide form & add the error messages

  }

[msnhockey]

thanks for reply.

not sure what this string is mysql_real_escape_string so i'm gonna read up on it first and then try with the layout you provided.

thanks for some insight

[msnhockey]

Ok..so i finally got the thing to validate and such, but now it takes away my ability to import the image to the directory..

not sure where the problem is because i never changed anything with that at all

here is my current code minus the db info

<?php

$post = isset($_GET['post'])?$_GET['post']:"";

if ($post == "yes") {

    $UPLOADED_PHOTO = $_FILES['NEW_PHOTO']['name']; 


    $fname = $_POST['fname'];
    $lname= $_POST['lname'];
    $address = $_POST['address'];
    $city = $_POST['city'];
    $state = $_POST['state'];
    $zip = $_POST['zip'];
    $phone = $_POST['phone'];
    $attending = $_POST['attending'];
    $email = $_POST['email']; 






$error_msg=array(); 

if ($fname == ''){
	$error_msg[]="Please enter your First name";
}

if(!preg_match('/^\b[a-zA-Z]+\b$/', $fname)){
	$error_msg[]="First Name can only contain letters";
}


if ($lname == ''){
	$error_msg[]="Please enter your last name";
}

if(!preg_match('/^\b[a-zA-Z]+\b$/', $lname)){
	$error_msg[]="Last Name can only contain letters";
}

if ($address == ''){
	$error_msg[]="Please enter your address";
}

if(!preg_match('/^[a-z0-9 ]*$/i', $address)){
	$error_msg[]="Address can only contain numbers, letters and spaces";
}


if ($city == ''){
	$error_msg[]="Please enter your city";
}

if (!preg_match('/^\b[a-zA-Z ]+\b$/', $city)){
	$error_msg[]="City can only contain letters";
}

if ($state == ''){
	$error_msg[]="Please enter your state";
}

if (strlen($state)<>2){
	$error_msg[]="State can only contain 2 letters; use state abbreviation";
}

if (!preg_match("/^\b[a-zA-Z]+\b$/", $state)){
	$error_msg[]="State can only contain letters";
}

if ($zip == ''){
	$error_msg[]="Please enter your zip code";
}

if (strlen($zip)<>5){
	$error_msg[]="Zip code can only contain 5 digits";
}

if(!is_numeric($zip)){
	$error_msg[]="Zip code must contain only numbers";
}

if ($phone == ''){
	$error_msg[]="Please enter your phone number";
}

if (strlen($phone)<>10){
	$error_msg[]="Phone number can only contain 10 digits";
}

if(!is_numeric($phone)){
	$error_msg[]="Phone number must contain only numbers";
}

if ($attending == ''){
	$error_msg[]="Please enter if you plan to attend";
}


if ($email == ''){
	$error_msg[]="Please enter your e-mail address";
}






if ($error_msg){
	$display_errors =  "
<table background='http://ufhl.theufhl.com/images/images/signupbk1.gif' width='640' height='560'> 
<td valign='top' align='center'>
<table border='0' width='600' cellspacing='0' cellpadding='0'>
<tr><td height='66'></td></tr>	
<TR>
<td width='25' height='30'></td>
<TD class=table_header>
<h3>There were errors in your submission.</h3>
		<p>Please review the following errors, press the Back button on your browser, and make corrections before re-submitting.</p>
		<ul style=color:red>\n";
			foreach ($error_msg as $err){
				$display_errors .= "<li>".$err."</li>\n";
			}
		$display_errors .= "</ul>\n

<p class=header align=center>GO <a href='javascript:history.go(-1)'><u>BACK</u></a> AND TRY AGAIN.</p>  





 </td></tr></td>
</table></table>";

}

if (!$error_msg){
$sql = "INSERT INTO robert (
id,fname,lname,address,city,state,zip,phone,attending,email,NEW_PHOTO $addl_insert_crit ) VALUES ( '$id',
'$fname','$lname','$address','$city','$state','$zip','$phone','$attending','$email','$UPLOADED_PHOTO' $addl_insert_values )";
	if ($sql_debug_mode==1) { echo "<BR>SQL: $sql<BR>"; } 
	$result = mysql_query($sql,db());

echo "<table background='http://ufhl.theufhl.com/images/images/signupbk1.gif' width='640' height='560'> 
<td valign='top' align='center'>
<table border='0' width='600' cellspacing='0' cellpadding='0'>
<tr><td height='66'></td></tr>	
<TR>
<td width='25' height='30'></td>
<TD class=table_header>Thank you <font color='red'>$fname $lname </font>for completing the online RSVP form for the company's Christmas party. <br><br> Below you will find the details of the form you submitted. You will also be sent an e-mail with the information you provided and details of the Christmas party.
<br><br>
<b>Name:</b> $fname $lname<br>
<b>Address:</b> $address<br>
<b>City:</b> $city<br>
<b>State:</b> $state <b>Zip Code:</b> $zip<br><br>
<b>Phone:</b> $phone<br><br>
<b>Is Attending:</b> $attending<br><br>
<b>Photo:</b><br>";

if($_FILES["NEW_PHOTO"]["name"] != ""){
echo "
<img src='http://www.theufhl.com/images/news/thumb/". $_FILES["NEW_PHOTO"]["name"] ."'><br>
<a href='http://www.theufhl.com/images/news/". $_FILES["NEW_PHOTO"]["name"] ."'>". $_FILES["NEW_PHOTO"]["name"] ."</a>";
    } else {
echo "
No Image Submitted";
    }
echo "

  </td></tr></td></table></table>";



$to = "[e-mail]";
$subject = "XMAS RSVP for ($fname $lname)";
$body = "This is a Message to let you know that $fname $lname has completed the online RSVP company Christmas form.

//Text goes here to send the webmaster or desired person an e-mail

";
if (mail($to, $subject, $body)) {

 }

$to1 = "$email";
$subject1 = "Jeppson Enterprise Christmas Party";
$body1 = "Hi $fname,

//text goes here for sending in email


Below you will find details of what you submitted

Name: $fname $lname
Address: $address
City: $city
State: $state  Zip Code:$zip

Phone: $phone

Is Attending: $attending

Photo: http://www.theufhl.com/images/news/". $_FILES["NEW_PHOTO"]["name"] ."
";
if (mail($to1, $subject1, $body1)) {

 }



} 

echo $display_errors;

} 



if (!$post) {






?>
	<form method="post" action="<?php echo $_SERVER['PHP_SELF']; ?>?proc=New&post=yes" enctype="multipart/form-data">
	<center>
<body topmargin='0' leftmargin='0' rightmargin='0' bottommargin='0'>

 <div align='center'>
	<table background='http://ufhl.theufhl.com/images/images/signupbk1.gif' width='640' height='560'>
		<tr>
	<td valign='top' align='center'>
	<table border='0' width='340' cellspacing='0' cellpadding='0'>

<tr><td height='66'></td></tr>	
<tr><td></td></tr>

<tr>
<td width='25' height='30'></td>
<td></td>
<td class='table_text' colspan='2'>
<input class='table_text' type='hidden' name='id'>
</td>
</tr>	


<tr>
<td width='25' height='30'></td>
<td bgcolor='#dfdfdf' class='table_header'>First Name:</td>
<td bgcolor='#dfdfdf' class='table_text' colspan='2'>
<input class='table_text' type='text' name='fname'>
</td>
</tr>		

<tr>
<td width='25' height='30'></td>
<td class='table_header'>Last Name:</td>
<td class='table_text' colspan='2'>
<input class='table_text' type='text' name='lname'>
</td>
</tr>

<tr>
<td width='25' height='30'></td>
<td class='table_header' bgcolor='#dfdfdf'>Address:</td>
<td class='table_text' bgcolor='#dfdfdf'>
<input class='table_text' type='text' name='address'>
</td>
</tr>

<tr>
<td width='25' height='30'></td>
<td class='table_header'>City:</td>
<td class='table_text'>
<input class='table_text' type='text' name='city'>
</td>
</tr>

<tr>
<td width='25' height='30'></td>
<td class='table_header' bgcolor='#dfdfdf'>State:</td>
<td class='table_text' bgcolor='#dfdfdf'>
<input class='table_text' type='text' name='state'>
</td>
</tr>

<tr>
<td width='25' height='30'></td>
<td class='table_header'>Zip Code:</td>
<td class='table_text'>
<input class='table_text' type='text' name='zip'>
</td>
</tr>

<tr>
<td width='25' height='30'></td>
<td class='table_header' bgcolor='#dfdfdf'>Phone:</td>
<td class='table_text' bgcolor='#dfdfdf'>
<input class='table_text' type='text' name='phone'>
</td>
</tr>

<tr>
<td width='25' height='30'></td>
<td class='table_header'>Attending:</td>
				<td class='table_text'>
				<select name='attending' class='table_text' style='width:78%'>
				<option value=' '></option>
				<option value='Yes'>Yes</option>
				<option value='No'>No</option>
                                </select>

</td>
</tr>

<tr>
<td width='25' height='30'></td>
<td class='table_header' bgcolor='#dfdfdf'>E-Mail:</td>
<td class='table_text' bgcolor='#dfdfdf'>
<input class='table_text' type='text' name='email'>
</td>
</tr>

<tr>
<td width='25' height='30'></td>
<td class='table_header'>PHOTO:</td>
<td class='table_text'>
<input type='file' name='NEW_PHOTO' class='table_text'>
</td>
</tr>

<TR>
<TD>
</TD>
<TD>
</TD>

<TD>
<INPUT TYPE="SUBMIT" VALUE="Register" NAME="submit">
<INPUT TYPE="RESET" VALUE="Reset" NAME="reset">


</TD>
</TR>


</TABLE>
</CENTER>
<BR>
</FORM>

<?php
} //END if post=""

$uploaddir = "./images/news/"; 
$uploadthumb = "./images/news/thumb/"; 
include('./includes/SimpleImage.php');
include('./includes/function.php');
$uploadfile = $uploaddir . basename($_FILES['NEW_PHOTO']['name']);
$uploadthumbfile = $uploadthumb . basename($_FILES['NEW_PHOTO']['name']);

if (move_uploaded_file($_FILES['NEW_PHOTO']['tmp_name'], $uploadfile)) { 

$image = new SimpleImage();
$image->load($uploadfile); 
$image->resize(480,400); 
$image->save($uploadfile); 
$UPLOADED_PHOTO = basename($_FILES['NEW_PHOTO']['name']);
$thumb = new SimpleImage(); 
$thumb->load($uploadfile); 
$thumb->resize(110,75); 
$thumb->save($uploadthumbfile); 
}else{ 
$UPLOADED_PHOTO = $_POST['PHOTO']; 
}


?>

[leatherback]

Well..
You changed the example I gave you considerably. One of the things which I put in was:

if(count($error_msg == 0))

You change dthat to if(error_msg). That is not the same thing. And will act differently. You should always get a true on that, as you set it yourself:
$error_msg = array();

Furthermore: Use if .. else constructions, as it will help PhP to understand what you are doing, rather than

if($error_msg)

is(!@error_msg)

Furthermore: You should start with checking whether data was submitted.

My advice: Go back to the drawing board, and on a piece of paper make a processing outling of the script, very much like I posted earlier. Make sure you take logical steps, and try to test for each case only once (So: You test whether a post was made, if so, do all the work that needs to be done when a post was made. Else, do the work that is to be done for a first time load.)

Only if you organize your thinking & logic first will you get rid of systematic errors from the code. Once you have this basic outline, you can just set up you if / then / else outline, and fill each section.

[msnhockey]

i tried using this if(count($error_msg == 0)) and $fname = mysql_real_escape_string($_POST['fname']); and i got alot of errors so i went back to my old way and found were i should put the INSERT thing.

It all works right. it validates the only problem is now is that it doesnt upload the pic to the folder

[leatherback]

msnhockey;10985569 wrote:

i tried using this if(count($error_msg == 0)) and $fname = mysql_real_escape_string($_POST['fname']); and i got alot of errors so i went back to my old way and found were i should put the INSERT thing.

It all works right. it validates the only problem is now is that it doesnt upload the pic to the folder

Hm.. You get error messages so you decide not to use the advice and go your own way. then you are surprised that you do not get the result you expect, claim that all works. Yet you do not get to upload the image. I think this here is my last post in this thread; Just one thing for you to consider: Where do you actually handle the fileupload? I do not see you move the temp file to the permanent location

[msnhockey]

I got the image to load here now
i needed to change
$uploaddir = "./images/news/";
$uploadthumb = "./images/news/thumb/";

to this

	$uploaddir = $_SERVER['DOCUMENT_ROOT']."/images/news/"; 
	$uploadthumb = $_SERVER['DOCUMENT_ROOT']."/images/news/thumb/"; 

and it all works great and as intended.. thanks for your help but i just didnt understand it, but i got it working so all is good

[msnhockey]

Hey leatherback

even though i got mine to work i took your advice and went back to the drawing board and your example you provided. I started in small steps and kept adding stuff in slowly and finally got it to work.

I found something in my code that was giving me the errors with the stuff you provided.

the only thing i didnt use that you provided was this
$fname = mysql_real_escape_string($POST['fname']);
I kept it like
$fname = $POST['fname'];

i used this if(count($error_msg == 0)) instead of if($error_msg)

After i finished with mine last night I did some more reading on the else, if, is stuff so i removed the if like i had and went with else. just like i read and you said it will help make it understand on what i want to do.

I still dont quite understand the mysql_real_escape string but im gonna keep looking at it until i do.

again thanks.

[leatherback]

Hi Mike,

You really must add some form of variable checking before going live with this. The reason is.. sql injection.

The mysql_real_escape_string is just one of the options.

The error you might get is a complain about the argument needing to be a string, none provided or something. That means you need to check whether the variable is set first:

$username = isset($_POST['username']) ? mysql_real_escape_string($_POST['username']) : '';

I personally have a little function that will try to get a variable from either $POST or $GET (Usefull when you have a search form & paginated results, so the variable may come from url or post) and takes argument whether input would be array, numeric or string and handle accordingly. But the line above should give a good start.

[bradgrafelman]

leatherback;10985648 wrote:

You really must add some form of variable checking before going live with this. The reason is.. sql injection.

And that's not even the only reason; not sanitizing inputs can easily lead to people accidentally breaking your code. Example:

$_POST['name'] = "Brian O'Connor";

$sql = "SELECT * FROM foo WHERE name = '$_POST[name]'";
// query: SELECT * FROM foo WHERE name = 'Brian O'Connor'
// result: syntax error; string 'Brian O' is followed by Connor, which isn't a SQL keyword

Also don't forget that mysql_real_escape_string/b is only appropriate for sanitizing string data - not numeric data.