Sure..
bradgrafelman;10993716 wrote:[indent]2. You never first check to see if data was POST'ed to your PHP script at all.[/indent]
If nothing was POST'ed to your script (for example, say a user or webcrawler manually visited this script directly - thus using a simple GET request), then that usually drastically changes what you want to do next. As such, you'll often see all of the form processing code wrapped in an if() statement like so:
if(isset($_POST['submit'])) {
// POST'ed data exists, submit button detected;
// process POST'ed data here
} else {
// submit button not detected, assuming desired POST'ed data doesn't exist
// display form we expected to process here, or redirect the user, or ... do something else
}
bradgrafelman;10993716 wrote:[indent]3. You've hard-coded the value of $selection rather than using the value that was selected in the HTML form.[/indent]
On line #2, you have this:
$selection = 'Mantles';
$selection therefore has nothing to do with the data that was POST'ed and instead is simply assigned the value 'Mantles'. Instead, you'll probably want to assign to it the value of the similarly-named POST'ed form entity; see [man]variables.external[/man] if you don't know how to do reference external POST'ed data.
bradgrafelman;10993716 wrote:[indent]4. You never verify that the file upload was successful before attempting to move it.[/indent]
Before doing anything with the entry in the $_FILES array, you should first check it's error code to ensure that it is equal to the constant UPLOAD_ERR_OK; if it isn't, then there's no point in trying to do anything with the uploaded file (since it doesn't exist due to some error). Instead, you could output an error message appropriate to whichever error occurred (file wasn't received correctly, file was too big, etc.); see [man]features.file-upload.errors[/man] for more info on the different error conditions/values.
