PHP Upload problem - apostrophe

[kamal213]

Hi Guys

 

I have this PHP Upload Scripts below which uploads file of customers into the customers folder and at the same time inserts the file path into the database.

 

The problems is for name like O'hare or O'neil its uploads into the customers folder but does not insert the file path into the database - probably because of the " ' " apostrophe

 

From the code below is there anyway I can deal with this issue?  Thanks alot

 

<?php 
//This php block of code will takecare of inserting the upload variables into the db

if(isset($_POST['submitbutton'])) {
$target_path = 'customerUploads/' . $check_id . ', ' . $c_name . '/';		
$target_path = $target_path . basename( $_FILES['upload']['name']);
$manager= mysql_real_escape_string($_POST['username']);
$upload =  $_FILES['upload']['name'];
$check_id = mysql_real_escape_string($_POST['id']);
$submitbutton= mysql_real_escape_string($_POST['submitbutton']);



if($submitbutton)
{
if($manager&&$upload)
{
if (file_exists($target_path))
{
echo $_FILES["upload"]["name"] . " already exists. ";
}
else
{
move_uploaded_file($_FILES["upload"]["tmp_name"],$target_path);
echo "Stored in: " . 'customerUploads/' . $check_id . ', ' . $c_name . '/' . $_FILES["upload"]["name"];

$insert=mysql_query("INSERT INTO img_up (username,upload,id,target_path,img_date) VALUES ('$manager','$upload','$check_id','$target_path', now()) ");

		// Where the file is going to be placed 
		$target_path = 'customerUploads/' . $check_id . ', ' . $c_name . '/';

		/* Add the original filename to our target path.  
		Result is "uploads/filename.extension" */
		$target_path = $target_path . basename( $_FILES['upload']['name']); 

		$target_path = 'customerUploads/' . $check_id . ', ' . $c_name . '/';

		$target_path = $target_path . basename( $_FILES['upload']['name']); 

		if (file_exists($target_path))
		{
		echo $_FILES["upload"]["name"] . " already exists. ";
		}
		else
		{
		move_uploaded_file($_FILES["upload"]["tmp_name"],$target_path);
		echo "Stored in: " . 'customerUploads/' . $check_id . ', ' . $c_name . '/' . $_FILES["upload"]["name"];
		}


}
}
else
{
echo "There was an error uploading the file, please try again!";
}
}
 header("location: mainupload_complete.php?id=$check_id"); 
}
?>

[AyKay47]

yes it will cut the string prematurely.. I would use str_replace() to remove apostrophes from the file name..

[kamal213]

Thanks for getting back

 

would it be

$upload = str_replace();

and also would I have to set parameters for the str_replace() such as 'str_replace("'")'

 

Thanks

[AyKay47]

$upload =  $_FILES['upload']['name'];
$upload = str_replace("'","",$upload);

[kamal213]

I have included it just as shown below but it doesnt seem to work am obviously doin something wrong.

 

<?php 
//This php block of code will takecare of inserting the upload variables into the db

if(isset($_POST['submitbutton'])) {
$target_path = 'customerUploads/' . $check_id . ', ' . $c_name . '/';		
$target_path = $target_path . basename( $_FILES['upload']['name']);
$manager= mysql_real_escape_string($_POST['username']);
$upload =  $_FILES['upload']['name'];
$upload = str_replace("'","",$upload);
$check_id = mysql_real_escape_string($_POST['id']);
$submitbutton= mysql_real_escape_string($_POST['submitbutton']);


if($submitbutton)
{
if($manager&&$upload)
{
if (file_exists($target_path))
{
echo $_FILES["upload"]["name"] . " already exists. ";
}
else
{
move_uploaded_file($_FILES["upload"]["tmp_name"],$target_path);
echo "Stored in: " . 'customerUploads/' . $check_id . ', ' . $c_name . '/' . $_FILES["upload"]["name"];

$insert=mysql_query("INSERT INTO img_up (username,upload,id,target_path,img_date) VALUES ('$manager','$upload','$check_id','$target_path', now()) ");

		// Where the file is going to be placed 
		$target_path = 'customerUploads/' . $check_id . ', ' . $c_name . '/';

		/* Add the original filename to our target path.  
		Result is "uploads/filename.extension" */
		$target_path = $target_path . basename( $_FILES['upload']['name']); 

		$target_path = 'customerUploads/' . $check_id . ', ' . $c_name . '/';

		$target_path = $target_path . basename( $_FILES['upload']['name']); 

		if (file_exists($target_path))
		{
		echo $_FILES["upload"]["name"] . " already exists. ";
		}
		else
		{
		move_uploaded_file($_FILES["upload"]["tmp_name"],$target_path);
		echo "Stored in: " . 'customerUploads/' . $check_id . ', ' . $c_name . '/' . $_FILES["upload"]["name"];
		}


}
}
else
{
echo "There was an error uploading the file, please try again!";
}
}
 header("location: mainupload_complete.php?id=$check_id"); 
}
?>[/code[]

[AyKay47]

what exactly is going wrong

[kamal213]

It Works Now I had to do the same with the Target path.. i.e

$target_path = str_replace("'","",$target_path);

 

Thanks alot you saved da day

 

Problem solved

[Pikachu2000]

Post the markup for the form also.

[Pikachu2000]

Never mind the form markup. You aren't escaping the file path variable before using it in the db query. You need to escape all form data before using it in a query string.

[kamal213]

Why do I need2 do this?

[Pikachu2000]

You mean besides the fact that not escaping strings leaves you open to SQL injection? Because obviously not doing so breaks the query when there's a quote in a string.