File upload script Question

[myliberty]

I am working on a website as a surprise gift for my son. I have a form that has several fields one of which is an upload field. Also it creates a directory based on a form field and adds the photo to that folder then all of the info is added to a database. All of that works great. What I need to do is figure out how, if a photo is not uploaded that it will put images/picholder.jpg (which is a default image) in that field so when the form is submitted that info will go in the database in place of a blank space if no photo is uploaded. Here is what I have so far

   //Check that we have a file


if((!empty($_FILES["photo"])) && ($_FILES['photo']['error'] == 0)) {

  //Check if the file is a valid image and it's size is less than 350Kb
  $filename = basename($_FILES['photo']['name']);
  $ext = substr($filename, strrpos($filename, '.') + 1);
  if (($ext == "jpg" || $ext == "JPG" || $ext == "jpeg" || $ext == "JPEG" || $ext == "pjpeg" || $ext == "gif" || $ext == "png")
 &&  ($_FILES["photo"]["size"] < 350000)) {

//Determine the path to which we want to save this file /images/ can be changed to where ever you want base to be
    $newname = dirname(__FILE__).'/images/'.$folder.'/'.$filename;

  //Check if the file with the same name already exists on the server
  if (!file_exists($newname)) {

    //Attempt to move the uploaded file to it's new place
    if ((move_uploaded_file($_FILES['photo']['tmp_name'],$newname))) {

       echo "<center><h3>It's done! The file  ".$filename;
       echo "<center><h4>has been saved in the new folder ".$folder;
       echo "<center><h4>and the listing was added to the Database!";
       echo "<center><h4><a href='listview.php'>View Listing</a>";
    } else { 
     echo "<center><h3>Error: A problem occurred during file upload!";
    echo "<center><h4><a href='listadd.php'>Go Back</a>";
    }
  } else {
     echo "<center><h3>Error: File ".$_FILES["photo"]["name"]." already exists!";
     echo "<center><h4><a href='listadd.php'>Go Back</a>";
  }
  } else {
     echo "<center><h3>Error: Only .jpg .gif and .png images under 350Kb are accepted for upload!";
     echo "<center><h4><a href='listadd.php'>Go Back</a>";
  }
} 
else {

echo "<center><h3>No file uploaded";
}  

everything I have tried has not worked

Thank you in advance.

[bradgrafelman]

What have you tried? Since you haven't shown us the code that inserts data into the database, we can only guess at what needs to be done.

[myliberty]

Sorry, I guess that's what happens when you stare at code for hours. Here is the rest of the code which is above what I posted earlier

//This gets all the other information from the form
   $id        = isset($_POST['Id'])        ? $_POST['Id']        : 'NULL'; 
   $date      = isset($_POST['Date'])      ? $_POST['Date']      : ''; 
   $mls      = isset($_POST['Mls'])      ? $_POST['Mls']      : ''; 
   $address  = isset($_POST['Address'])  ? $_POST['Address']  : ''; 
   $beds  = isset($_POST['Beds'])  ? $_POST['Beds']  : ''; 
   $baths  = isset($_POST['Baths'])  ? $_POST['Baths']  : '';
   $year  = isset($_POST['Year'])  ? $_POST['Year']  : '';
   $sqft     = isset($_POST['Sqft'])     ? $_POST['Sqft']     : ''; 
   $price     = isset($_POST['Price'])     ? $_POST['Price']     : '';  

   $area  = isset($_POST['Area'])  ? $_POST['Area']  : '';  

   $details   = isset($_POST['Details'])   ? $_POST['Details']   : ''; 
   $status  = isset($_POST['Status'])  ? $_POST['Status']  : '';  

   $photo=($_FILES['photo']['name']);


// Connects to your Database
 require('dbcadmin.php');


//Writes the information to the database
   $stmt = $conn->prepare("INSERT INTO listings (id, date, mls, address, photo, beds, baths, year, sqft, price, area, details, status) \n". 
                              " VALUES (:id, :date, :mls, :address, :photo, :beds, :baths, :year, :sqft, :price, :area, :details, :status) "); 

  $success = $stmt->execute(array(':id'=>$id, ':date'=>$date, ':mls'=>$mls, ':address'=>$address, ':photo'=>$photo, ':beds'=>$beds, ':baths'=>$baths, ':year'=>$year, ':sqft'=>$sqft, ':price'=>$price, ':area'=>$area, ':details'=>$details, ':status'=>$status)); 
/////////Create a directory from mls number Change $dirpath = images/ to where you want the Directory created


$folder = $_POST['Mls'];  
$dirPath = "images/".$folder;  

$result = mkdir($dirPath, 0755);  
 if ($result == 1) {  
echo "<center><h3> A new folder ";  
echo $dirPath . " has been created</h3>";  
echo "<center><h4><a href='listview.php'>View Listing</a>";
} else {  

     echo "<center><h3> There was an ERROR new folder  ";  

     echo $dirPath . " has NOT been created</h3>"; 
     echo "<center><h4><a href='listadd.php'>Go Back</a>"; 
}  

Like I said it all works fine if a file is uploaded the name goes in the photo field in the db but if no photo is uploaded then that field is empty. And I want it to put images/picholder.jpgthere.

Thanks

[johanafm]

myliberty;11035581 wrote:

$id = isset($_POST['Id']) ? $_POST['Id'] : 'NULL';
$date = isset($_POST['Date']) ? $_POST['Date'] : '';
$mls = isset($_POST['Mls']) ? $_POST['Mls'] : '';
$address = isset($_POST['Address']) ? $_POST['Address'] : '';
$beds = isset($_POST['Beds']) ? $_POST['Beds'] : '';
$baths = isset($_POST['Baths']) ? $_POST['Baths'] : '';
$year = isset($_POST['Year']) ? $_POST['Year'] : '';
$sqft = isset($_POST['Sqft']) ? $_POST['Sqft'] : '';
$price = isset($_POST['Price']) ? $_POST['Price'] : '';
$area = isset($_POST['Area']) ? $_POST['Area'] : '';
$details = isset($_POST['Details']) ? $_POST['Details'] : '';
$status = isset($_POST['Status']) ? $_POST['Status'] : '';
$photo=($_FILES['photo']['name']);

Can you spot what you are doing with ALL your $_POST elements but are NOT doing with the $_FILES element?

A separate but very serious issue is that you have no control over the id value. This means that any user can actually edit all data - wether they are actually supposed to be able to do so or not.

[myliberty]

johanafm;11035585 wrote:

Can you spot what you are doing with ALL your $POST elements but are NOT doing with the $FILES element?

A separate but very serious issue is that you have no control over the id value. This means that any user can actually edit all data - wether they are actually supposed to be able to do so or not.

Okay not sure I understand. As I said it works now if a file is uploaded all of the information gets posted to the db including what photo was uploaded. I can't figure out where to to tell it if no photo is uploaded then put images/picholder.jpg in that field. As far as the other it is for the admin section so no one will be entering info but me.

[bradgrafelman]

myliberty;11035591 wrote:

I can't figure out where to to tell it if no photo is uploaded then put images/picholder.jpg in that field.

Here's a big hint: the correct location to insert code when no file was uploaded should be next to/in place of the echo statement containing "No file uploaded." However, note that statement might not be correct, since you'd also reach that statement if a file was uploaded but some sort of error occurred.

[myliberty]

bradgrafelman;11035593 wrote:

Here's a big hint: the correct location to insert code when no file was uploaded should be next to/in place of the echo statement containing "No file uploaded." However, note that statement might not be correct, since you'd also reach that statement if a file was uploaded but some sort of error occurred.

Okay so how does that make sense. Either it goes there or it doesn't. I have tried
this code and variations there and nothing so far

if (empty($_FILES["photo"])) {
    $photo = $_FILES["image/picholder.jpg"];

 }

[bradgrafelman]

myliberty;11035595 wrote:

Okay so how does that make sense. Either it goes there or it doesn't.

Sorry, I meant to say that the text in the echo statement may be incorrect since a user might have actually attempted to upload a file but an error occurred.

myliberty;11035595 wrote:

I have tried
this code and variations there and nothing so far

if (empty($_FILES["photo"])) {
    $photo = $_FILES["image/picholder.jpg"];

 }

That's because the $_FILES array won't contain an element with a key of "image/picholder.jpg" since you don't have any <input type="file"> HTML entities that use that value as a name. You probably want to set $photo equal to the string "image/picholder.jpg" instead.

I'm not sure where you're placing that if() statement, but again note that you already have an if() statement that checks if a file was uploaded successfully - the 'else' branch of that if() statement is where you'll want to make this variable assignment. Additionally, the if() statement in the code snippet you posted above is really only catching a border case; you'd also want to check to see if the error value is equal to UPLOAD_ERR_NO_FILE (see manual page [man]features.file-upload.errors[/man]).

[myliberty]

bradgrafelman;11035599 wrote:

Sorry, I meant to say that the text in the echo statement may be incorrect since a user might have actually attempted to upload a file but an error occurred.

That's because the $_FILES array won't contain an element with a key of "image/picholder.jpg" since you don't have any <input type="file"> HTML entities that use that value as a name. You probably want to set $photo equal to the string "image/picholder.jpg" instead.

I'm not sure where you're placing that if() statement, but again note that you already have an if() statement that checks if a file was uploaded successfully - the 'else' branch of that if() statement is where you'll want to make this variable assignment. Additionally, the if() statement in the code snippet you posted above is really only catching a border case; you'd also want to check to see if the error value is equal to UPLOAD_ERR_NO_FILE (see manual page [man]features.file-upload.errors[/man]).

So I am putting the if statement in the else like this

else {

/////////////////////////////////////
if((empty($_FILES["photo"])) && ($_FILES['photo']['error'] == 4)) {

$photo = "images/picholder.jpg";
 }else
//////////////////////////////////

echo "<center><h3>There was an error";
}

I am having a tough time figuring out what syntax is correct I am not a programmer at all.

[myliberty]

myliberty;11035605 wrote:

So I am putting the if statement in the else like this

else {

/////////////////////////////////////
if((empty($_FILES["photo"])) && ($_FILES['photo']['error'] == 4)) {

$photo = "images/picholder.jpg";
 }else
//////////////////////////////////

echo "<center><h3>There was an error";
}

I am having a tough time figuring out what syntax is correct I am not a programmer at all.

Well after hours of rearranging this I still can't figure it out. I don't know what else to try.