PHP/MySql Submission Form

ryanharper · July 11, 2011

Hello all! I am working on a submission form at a website of my. I have it working except that I originally wrote the script to upload files into Mysql. I realized that his is not the method I need and am trying to change the script to upload the selected file into a directory and the link to this directory to go into mysql.

Here is the upload.php code

____________________________________________________________________

<?php

include 'dbc.php';

page_protect();

$table = 'upload';

// use the same name as SQL table

$password = 'XXXXXX';

// simple upload restriction,

// to disallow uploading to everyone

// This function makes usage of

// $_GET, $_POST, etc... variables

// completly safe in SQL queries

function sql_safe($s)

{

if (get_magic_quotes_gpc())

$s = stripslashes($s);

return mysql_real_escape_string($s);

}

// If user pressed submit in one of the forms

if ($_SERVER['REQUEST_METHOD'] == 'POST')

{

// cleaning title field

$title = trim(sql_safe($_POST['title']));

$name = ($_POST['name']);

$type = ($_POST['type']);

$subject = ($_Post['subject']);

if ($title == '') // if title is not set

$msg = 'Error: enter username';

if ($name == '') // if name is not set

$msg = 'Error: enter file name';

if ($type == '') // if name is not set

$msg = 'Error: enter the file type';

if ($_POST['password'] != $password) // cheking passwors

$msg = 'Error: wrong upload password';

else

{

if (!isset($msg)) // If there was no error

{

$data = file_get_contents($_FILES['photo']['tmp_name']);

$data = mysql_real_escape_string($data);

// Preparing data to be used in MySQL query

mysql_query("INSERT INTO {$table}

SET type='$type', subject='$subject' , name='$name', title='$title',

data='$data'");

$msg = 'Success: file uploaded';

}

elseif (isset($_GET['title'])) // isset(..title) needed

$msg = 'Error: file not loaded';// to make sure we've using

// upload form, not form

// for deletion

if (isset($_POST['del'])) // If used selected some photo to delete

{ // in 'uploaded images form';

$id = intval($_POST['del']);

mysql_query("DELETE FROM {$table} WHERE id=$id");

$msg = 'Photo deleted';

}

elseif (isset($_GET['show']))

{

$id = intval($_GET['show']);

$result = mysql_query("SELECT ext, image_time, data

FROM {$table}

WHERE id=$id LIMIT 1");

if (mysql_num_rows($result) == 0)

die('no image');

list($ext, $image_time, $data) = mysql_fetch_row($result);

$send_304 = false;

if (php_sapi_name() == 'apache') {

// if our web server is apache

// we get check HTTP

// If-Modified-Since header

// and do not send image

// if there is a cached version

$ar = apache_request_headers();

if (isset($ar['If-Modified-Since']) && // If-Modified-Since should exists

($ar['If-Modified-Since'] != '') && // not empty

(strtotime($ar['If-Modified-Since']) >= $image_time)) // and grater than

$send_304 = true; // image_time

}

if ($send_304)

{

// Sending 304 response to browser

// "Browser, your cached version of image is OK

// we're not sending anything new to you"

header('Last-Modified: '.gmdate('D, d M Y H:i:s', $ts).' GMT', true, 304);

exit(); // bye-bye

}

// outputing Last-Modified header

header('Last-Modified: '.gmdate('D, d M Y H:i:s', $image_time).' GMT',

true, 200);

// Set expiration time +1 year

// We do not have any photo re-uploading

// so, browser may cache this photo for quite a long time

header('Expires: '.gmdate('D, d M Y H:i:s', $image_time + 86400*365).' GMT',

true, 200);

// outputing HTTP headers

header('Content-Length: '.strlen($data));

header("Content-type: image/{$type}");

// outputing image

echo $data;

exit();

}

?>

<?php include("upheader.html"); ?>

<?php

if (isset($msg)) // this is special section for

// outputing message

{

?>

<br>

<a href="<?=$PHP_SELF?>">reload page</a>

<!-- I've added reloading link, because

refreshing POST queries is not good idea -->

</p>

<?php

}

?>

</form>

<h2>Upload new file:</h2>

<form action="<?=$PHP_SELF?>" method="POST" enctype="multipart/form-data">

<label for="title">Username:</label><br>

<label for="subject">Subject:</label><br>

<option value="acct">Accounting</option>

<option value="anth">Anthropology</option>

<option value="bio">Biology</option>

<option value="chem">Chemistry</option>

<option value="comm">Communications</option>

<option value="econ">Economics</option>

<option value="engl">English</option>

<option value="fmgt">Finance</option>

<option value="geog">Geography</option>

<option value="grph">Graphic Design</option><br>

<option value="hum">Humanities</option>

<option value="cit">Information Technology</option>

<option value="mkgt">Marketing</option>

<option value="phil">Philosophy</option>

<option value="pols">Political Science</option>

<option value="psy">Psychology</option>

<option value="soc">Sociology</option>

</select><br><br>

</select><br><br>

<label for="photo">Select File:</label><br>

<label for="password">Password:</label><br>

</form>

<?php include("footer.html"); ?>

_______________________________________________________

the database is:

Field Type Collation Attributes Null Default Extra Action

id int(11) No auto_increment

title varchar(64) utf8_general_ci No

subject varchar(40) utf8_general_ci No

name varchar(60) utf8_general_ci No

type varchar( utf8_general_ci No

image_time on update current timestamp No

data text utf8_general_ci No

*id is primary

PLEASE HELP!!!

I have tried a few different options but cannot get the file to the directory or the link into the database. I think I have worked myself in circles at this point and need a fresh perspective... ANY thoughts or help is GREATLY appreciated!!!

rh

Kustom_Vegas · July 11, 2011

woah that alot of code to sort though

1. dont't use $PHP_SELF for the action of your form, leads to XSS injection...one option is to use "#" instead...

http://www.google.com/#sclient=psy&hl=en&source=hp&q=xss+injection+php_self&aq=f&aqi=&aql=f&oq=&pbx=1&bav=on.2,or.r_gc.r_pw.&fp=fce33a84b0764b22&biw=849&bih=200

2. you will want to use move_uploaded_file to move the uploaded file to a specifeid directory and an INSERT statement to insert the file path into your db table

ryanharper · July 11, 2011

i used the move_uploaded_file and upon upload got no errors but the file was not showing the directory. permissions were set correctly so I am confused...

Kustom_Vegas · July 11, 2011

move_uploaded_file is not in the code that you posted

ryanharper · July 11, 2011

i took it out as it was not working...

ryanharper · July 11, 2011

I moved this to the freelance forum... http://www.phpfreaks.com/forums/index.php?topic=338428.0

Sign In

PHP/MySql Submission Form

Recommended Posts

ryanharper

Link to comment

Share on other sites

Kustom_Vegas

Link to comment

Share on other sites

ryanharper

Link to comment

Share on other sites

Kustom_Vegas

Link to comment

Share on other sites

ryanharper

Link to comment

Share on other sites

ryanharper

Link to comment

Share on other sites

Join the conversation

Browse

Activity

Important Information