file upload error

[chris_rulez001]

hi ive got a problem with my file uploader:

 

Parse error: syntax error, unexpected T_ENCAPSED_AND_WHITESPACE, expecting T_STRING or T_VARIABLE or T_NUM_STRING in /home/www/hostsareus.awardspace.co.uk/file_upload2.php on line 49

 

my code:

 

<?php
$id = $_POST['id'];
$username = $_POST['username'];
if( $_FILES["file"]["type"] == "image/gif" 
|| $_FILES["file"]["type"] == "image/pjpeg" 
|| $_FILES["file"]["type"] == "image/png" 
|| $_FILES["file"]["type"] == "image/bmp" 
|| $_FILES["file"]["type"] == "movie/swf" 
|| $_FILES["file"]["type"] == "image/jpeg" 
|| $_FILES["file"]["type"] == "music/mp3" 
|| $_FILES["file"]["type"] == "music/wma" 
&& $_FILES["file"]["size"] < 5000 )
{
if ($_FILES["file"]["error"] > 0)
{
echo "Return Code: " . $_FILES["file"]["error"] . "<br />";
}
else
{
echo "<h4>Upload Successful!</h4><br/>";
echo "<strong>Upload:</strong> " . $_FILES["file"]["name"] . "<br /><br />";
echo "<strong>Type:</strong> " . $_FILES["file"]["type"] . "<br /><br />";
echo "<strong>Size:</strong> " . ($_FILES["file"]["size"] / 1024) . " Kb<br /><br />";
echo "<strong>Temp file:</strong> " . $_FILES["file"]["tmp_name"] . "<br /><br />";

if (file_exists("memberuploads/" . $_FILES["file"]["name"]))
{
echo $_FILES["file"]["name"] . " already exists. ";
}
else
{

move_uploaded_file($_FILES["file"]["tmp_name"],
"memberuploads/" . $_FILES["file"]["name"]);
echo "<strong>Stored in:</strong> " . "http://hostsareus.awardspace.com/memberuploads/" . $_FILES["file"]["name"];
echo "<br/><br/><strong>ALL</strong> inappropriate images, movies, music <strong>WILL</strong> be deleted!";
echo "<br/><br/>Click <a href='index.php'>here</a> to return to the homepage.";
$filename = $_FILES["file"]["name"];

mysql_connect("fdb1.awardspace.com", "******************", "****************")
or die ('Connection to database failed: ' . mysql_error());
mysql_select_db("************");

$today = date("D M d Y");
$filetype = $_FILES["file"]["type"];
$filesize = $_FILES["file"]["size"];
$ip = $_SERVER['REMOTE_ADDR'];

mysql_query("INSERT INTO tracking(id, username, date, ipaddress, filename, filetype, filesize) VALUES ('$id', '$_SESSION['username']', '$today', '$ip', '$filename', '$filetype', '$filesize')");

}
}
}
else
{
echo "Invalid file";
}
?>

[Carterhost]

Try replacing this

mysql_query("INSERT INTO tracking(id, username, date, ipaddress, filename, filetype, filesize) VALUES ('$id', '$_SESSION['username']', '$today', '$ip', '$filename', '$filetype', '$filesize')");

with this

$username = $_SESSION['username'];
mysql_query("INSERT INTO tracking(id, username, date, ipaddress, filename, filetype, filesize) VALUES ('$id', '$username', '$today', '$ip', '$filename', '$filetype', '$filesize')");

the single quote in your $_SESSION['username'] is breaking the SQL string I think.