unique codes for delivery notes won't update to mysql

[mrsaywho]

I have a form that passes multiple images and I wanted them to have a substring of a md5 encrypted time for generating unique codes so I don't delete or overwrite an older file. I keep the actual images in a folder and the path in mysql. The folder is working perfectly and there are no problems generating unique codes but I have been trying all night and I can't figure out why mysql won't update. I can actually get it to update but then I loose the functionallity of the code and if I don't upload a 4 images and leave one blank, the blank one deletes the previously uploaded field in the table row.

 

Here is the md5 encrypted time for generating unique codes:

 

$unique = strtolower(substr(md5(time()), 0, 4));

 

This is how it works with the folder:

 

$filePath = $uploadDir . $unique . $fileName;

 

This is how I get it to update mysql but then loose functionality:

 

$values[$i] =  $unique . mysql_real_escape_string(basename(trim($_FILES[$fields[$i]]['name'])));

 

Here is the entire code:

 

<?php
require_once('storescripts/connect.php');
mysql_select_db($database_phpimage,$phpimage);
$unique = strtolower(substr(md5(time()), 0, 4));	
$uploadDir = 'upload/';

if(isset($_POST['upload' . $config]))
{
foreach ($_FILES as $file)
{

$fileName = $file['name'];
$tmpName = $file['tmp_name'];
$fileSize = $file['size'];
$fileType = $file['type'];

if($fileName==""){

$filePath = 'upload/';
}
else{

$filePath = $uploadDir . $unique . $fileName;
}

$filePath = str_replace(" ", "_", $filePath);
$result = move_uploaded_file($tmpName, $filePath);

if(!get_magic_quotes_gpc())
{
$fileName = addslashes($fileName);
$filePath = addslashes($filePath);
}
$fileinsert[]=$filePath;
}
}

$mid   = mysql_real_escape_string(trim($_POST['mid']));
$cat   = mysql_real_escape_string(trim($_POST['cat']));
$item  = mysql_real_escape_string(trim($_POST['item']));
$price = mysql_real_escape_string(trim($_POST['price']));
$about = mysql_real_escape_string(trim($_POST['about']));

$fields = array();
$values = array();
$updateVals = array();
for($i=1; $i<=4; $i++)
{
    $fields[$i] = 'name'.$i;
    $values[$i] =  mysql_real_escape_string(basename(trim($_FILES[$fields[$i]]['name'])));
    if($values[$i] != '')
    {
        $updateVals[] = "{$fields[$i]} = '{$values[$i]}'";
    }
}

$updateNames = '';
if(count($updateVals))
{
$updateNames =  ", " . implode(', ', $updateVals);
}

$update = "INSERT INTO image
               (mid, cid, item, price, about, name1, name2, name3, name4)
           VALUES
               ('$mid', '$cat', '$item', '$price', '$about', '$values[1]', '$values[2]', '$values[3]', '$values[4]')
           ON DUPLICATE KEY UPDATE
                cid = '$cat', item = '$item', price = '$price', about = '$about' $updateNames";
$result = mysql_query($update) or die (mysql_error());

$id = mysql_insert_id();

?>
<p style="font-size:35px; font-family:Arial, Helvetica, sans-serif; color:#255E67; margin-left:25px;">Your Item Has Been Uploaded!</p>
<script type="text/javascript">
setTimeout('ourRedirect()', 2000)
function ourRedirect() {
location.href='protator_php.php?mid=<?php echo $id ?>'
}
</script>

[Psycho]

Here is the md5 encrypted time for generating unique codes:

 

$unique = strtolower(substr(md5(time()), 0, 4));

 

This is how it works with the folder:

 

$filePath = $uploadDir . $unique . $fileName;

 

This is how I get it to update mysql but then loose functionality:

 

$values[$i] =  $unique . mysql_real_escape_string(basename(trim($_FILES[$fields[$i]]['name'])));

 

Well, you are creating a new name/path for the file (stored in the variable $filePath). But, then you set the value to be inserted into the database using the original name $_FILES[$fields[$i]]['name']. You should be storing the same value in the database that you are using to rename the file.

[cpd]

Additionally, your unique ID isn't truly unique. You could MD5 hash something else and the first 4 characters could be the same. For it to be truly unique you require the full MD5 hash.

[mrsaywho]

psycho, are you saying to change 'name' to $fileName in the code you highlighted?

[mrsaywho]

I can't figure out how to store the same name in the database as I do in the folder without losing the codes funcionality to update only one image at a time.

[mrsaywho]

ok so i found out that what is happening is the unique id is being posted across all 4 image uploads. it looks like name1=5674, name2=5674, name3=5674, name4=5674brown_hat.jpg, if i upload a photo to just name4. so the other 3 get overwritten because the code thinks i am uploading a file called 5674 or whatever the unique id may be.