MySQL insert skipping over field

[ultraloveninja]

I have a script that uploads and images, creates 2 versions of it, re-sizes the images and inserts all the info into a DB.

 

The odd thing is that if I don't have an image to upload, it will still run the script but it will completely skip over the description.  If I upload an image, it works fine.  Not too sure what the issue is.

Is it because my variable of $desc causing a conflict?

 

Here's my code:

 

<?php 
ini_set("display_errors",1);
include 'dbconn.php';

$change="";
$abc="";


define ("MAX_SIZE"," 10000");
function getExtension($str) {
         $i = strrpos($str,".");
         if (!$i) { return ""; }
         $l = strlen($str) - $i;
         $ext = substr($str,$i+1,$l);
         return $ext;
}

$errors=0;
  
if($_SERVER["REQUEST_METHOD"] == "POST")
{
	$image =$_FILES["file"]["name"];
$uploadedfile = $_FILES['file']['tmp_name'];
     

	if ($image) 
	{

		$filename = stripslashes($_FILES['file']['name']);

  		$extension = getExtension($filename);
		$extension = strtolower($extension);


if (($extension != "jpg") && ($extension != "jpeg") && ($extension != "png") && ($extension != "gif")) 
		{

			$change='<div class="msgdiv">Unknown Image extension </div> ';
			$errors=1;
		}
		else
		{

$size=filesize($_FILES['file']['tmp_name']);


if ($size > MAX_SIZE*1024)
{
$change='<div class="msgdiv">You have exceeded the size limit!</div> ';
$errors=1;
}


if($extension=="jpg" || $extension=="jpeg" )
{
$uploadedfile = $_FILES['file']['tmp_name'];
$src = imagecreatefromjpeg($uploadedfile);

}
else if($extension=="png")
{
$uploadedfile = $_FILES['file']['tmp_name'];
$src = imagecreatefrompng($uploadedfile);

}
else 
{
$src = imagecreatefromgif($uploadedfile);
}

echo $scr;

list($width,$height)=getimagesize($uploadedfile);


$newwidth=150;
$newheight=($height/$width)*$newwidth;
$tmp=imagecreatetruecolor($newwidth,$newheight);


$newwidth1=50;
$newheight1=($height/$width)*$newwidth1;
$tmp1=imagecreatetruecolor($newwidth1,$newheight1);

imagecopyresampled($tmp,$src,0,0,0,0,$newwidth,$newheight,$width,$height);

imagecopyresampled($tmp1,$src,0,0,0,0,$newwidth1,$newheight1,$width,$height);

$famname = $_POST['famname'];
$desc =  $_POST['description'];
$petname = $_POST['petname'];
$letter = $_POST['letter'];
$filename = "images/". $_FILES['file']['name'];
$filename1 = "images/small". $_FILES['file']['name'];



imagejpeg($tmp,$filename,100);

imagejpeg($tmp1,$filename1,100);

imagedestroy($src);
imagedestroy($tmp);
imagedestroy($tmp1);
}}

}

//If no errors registred, print the success message
if(isset($_POST['Submit']) && !$errors) 
{

$insert="insert ignore into tbl_tribue (petname,familyname,letter,description,imgpath,thumbpath) values ('$petname','$famname','$letter','$desc','$filename','$filename1')";
   mysql_query($insert);
   //mysql_query("update gallery set imgpath='$filename'");
	$change=' <div class="msgdiv">Pet Added Successfully!</div>';

print $insert;

}

?>

 

I had turned on the error and the print to see the output.  Anyone have any ideas?  Thanks!

[ultraloveninja]

anyone?

[litebearer]

have you echoed each variable (the ones you intend to add to the db)?

 

[ultraloveninja]

I did a print for the full insert string which comes up as this when I have a picture:

insert ignore into tbl_tribue (petname,familyname,letter,description,imgpath,thumbpath) values ('test','test','A','test','images/DSC00161-mod.jpg','images/smallDSC00161-mod.jpg')

 

and this is the print string when I do not have a pic:

 

insert ignore into tbl_tribue (petname,familyname,letter,description,imgpath,thumbpath) values ('tes2','test2','A','','','')

 

I can try to echo out the variables and get back in a few...

 

 

[litebearer]

Try moving ALL variables NOT related to pictures outside the image handling area (ie petname, description etc) to  just before your query. then try echoing out the query

[ultraloveninja]

Ok, I'll try that and get back to you in a bit.  Thanks!

[Pikachu2000]

You have $desc defined within the if( $image ) { conditional. If there's no image, it never gets a value. Your code is wide open to SQL injection too, since you aren't validating or sanitizing any of the user input.

[ultraloveninja]

Gotcha.

 

I moved all the other non-image variables outside of the image conditional stuff and it worked.  I am still working on it, so I am going to add the sanitary stuff now.

 

Thanks for all your help!