PHP Upload to MySQL

[rwachowiak]

So i installed Apache 2.2, PHP 5.something and MySQL on a extra server we had in the office. I made a database called intranet, a table called files, and the following fields:

 

id----int(11)----primary key

Filename----varchar(30)

Keyword1----varchar(30)

Keyword2----varchar(30)

Description----text

DateAdded----timestampCURRENT_TIMESTAMP

Type----varchar(30)

Size----int(11)

Content----mediumblob

 

Here is my script:

 

i thought the code tag would work but apparently not

 

here is a link to the code:

 

http://www.chiampou.com/code.php

 

 

 

When i try to upload a file, i get the "Error, insert query failed" Now, it was working before i put in the file part, with just filename, keyword 1 and 2 and the description. Since i threw the file part it i cant get it working... help please!

[rhodesa]

If you weren't allowed to post code, it means it had a function that is banned from being posted (like fopen). Post the code as an attachment using the Additional Options area.

[rwachowiak]

If you weren't allowed to post code, it means it had a function that is banned from being posted (like fopen). Post the code as an attachment using the Additional Options area.

 

thanks let me try...

 

 

ok thanks, its notes.txt is the code, take a look at it and let me know what you think please!

 

[rhodesa]

my guess is that you have some illegal characters in your SQL. Everything that is a string should be sent through mysql_real_escape_string() before getting executed. Here is the top part of the code re-written:

 

<?php
if(isset($_POST['add']))
{
include 'libs/dbopen.php';

$Keyword1 = mysql_real_escape_string($_POST['keyword1']);
$Keyword2 = mysql_real_escape_string($_POST['keyword2']);
$Description = mysql_real_escape_string($_POST['description']);

$fileName = $_FILES['userfile']['name'];
$tmpName  = $_FILES['userfile']['tmp_name'];
$fileSize = $_FILES['userfile']['Size'];
$fileType = $_FILES['userfile']['Type'];

$fp      = f_open($tmpName, 'r');
$content = f_read($fp, filesize($tmpName));
$content = mysql_real_escape_string($content);
f_close($fp);
$fileName = mysql_real_escape_string($fileName);
$fileType= mysql_real_escape_string($fileType);

//You should disable magic_quotes. It's been removed from PHP6
#if(!get_magic_quotes_gpc())
#{
#    $fileName = addslashes($fileName);
#}

$query = "INSERT INTO files (Filename, Keyword1, Keyword2, Description, Size, Type, Content) 
VALUES ('$fileName', '$Keyword1', '$Keyword2', '$Description', '$fileSize', '$fileType', '$content')";

mysql_query($query) or die('Error, insert query failed: '.mysql_error());
.....

 

NOTE: To be able to post it, i had to put underscores in the file handle functions. Make sure you remove them.

[rwachowiak]

 

NOTE: To be able to post it, i had to put underscores in the file handle functions. Make sure you remove them.

 

ok so i changed what you gave me, and now i get this:

 

Error, insert query failed: Incorrect integer value: '' for column 'Size' at row 1

 

any ideas?!  (im a scripting newb, all this is a tutorial but i had to try and customize a lot of it and failed horribly!)

[rhodesa]

Ah, these two lines need lower case keys. Here they are corrected:

$fileSize = $_FILES['userfile']['size'];
$fileType = $_FILES['userfile']['type'];

[rwachowiak]

Ah, these two lines need lower case keys. Here they are corrected:

$fileSize = $_FILES['userfile']['size'];
$fileType = $_FILES['userfile']['type'];

 

OMIGOD it worked! now i just gotta read the tutorial on how to setup the download! thanks!

[rhodesa]

nice, congrats. good luck with the download part. probably see you again soon then 

[rwachowiak]

nice, congrats. good luck with the download part. probably see you again soon then 

 

wow you were right, i think im really close though, i mouse over the filename link, and it says:

 

http://server/indextest.php?id=<?php=;?>

 

heres the code for that page: (i had to attach, i dont know whats stopping it this time)

[rhodesa]

Yup...you are using a start PHP tag when PHP is already started. This is the culprit:

echo "File Name: <span class='titlebar2'><a href='indextest.php?id=<?php=$id;?>'>{$row['Filename']}</a></span> <br>" .

it should be:

echo "File Name: <span class='titlebar2'><a href='indextest.php?id={$id}'>{$row['Filename']}</a></span> <br>" .

[rwachowiak]

Yup...you are using a start PHP tag when PHP is already started. This is the culprit:

echo "File Name: <span class='titlebar2'><a href='indextest.php?id=<?php=$id;?>'>{$row['Filename']}</a></span> <br>" .

it should be:

echo "File Name: <span class='titlebar2'><a href='indextest.php?id={$id}'>{$row['Filename']}</a></span> <br>" .

 

ok i made that change, now the link reads:

 

http://server/indextest.php?id=

 

Im guessing one of the ID pulling tags is wrong? its an edited/customized tutorial so some of the copy/pasting could be off

 

update: ok so i tried changing the {$id} to 18, (one of the IDs in my sql table) and it still doesnt work, it wants me to download indextest.php instead of the file in the database

[rhodesa]

Let's not get ahead of ourselves. Let's get that URL working first.

 

And I found my error, change that line to this and see if it works:

echo "File Name: <span class='titlebar2'><a href='indextest.php?id={$row['id']}'>{$row['Filename']}</a></span> <br>" .

[rwachowiak]

Let's not get ahead of ourselves. Let's get that URL working first.

 

And I found my error, change that line to this and see if it works:

echo "File Name: <span class='titlebar2'><a href='indextest.php?id={$row['id']}'>{$row['Filename']}</a></span> <br>" .

 

wow this is so exciting, you are so smart

 

ok it is changing the URL to the correct ID, but its still downloading indextest.php!

 

UPDATE: OK WAIT

 

Its downloading the file as: Indextest.php  but it IS the actual file. If i upload a .xls, and it downloads as the .php i change the extension and open it up with excel it is the document i uploaded! hmm, filename is weird somewheres...

 

OMG FOUND IT! I think its workkkking! let me take an extra look!

[rhodesa]

The only problem should be this line (I updated it):

header("Content-Disposition: attachment; filename=$name");

[rwachowiak]

The only problem should be this line (I updated it):

header("Content-Disposition: attachment; filename=$name");

 

no thats wrong, the field in my table is Filename, not name, there was somewhere else where it was still name instead of Filename, changed it and its working great! Now my next project is, to make links on that page run a qeuery, like if i click on Audit, it brings up all the files that have Keyword Audit... now THAT should take me a while hahaha

 

thanks for all your help you should see me back here frequently!

[rhodesa]

Either way should have worked

 

Good luck

[rwachowiak]

can you point me in the way of a tutorial to do the following:

 

have a link do a qeuery and have it put the results like:

 

index.php?=results

 

or something like that...

 

thanks!

[rwachowiak]

can you point me in the way of a tutorial to do the following:

 

have a link do a qeuery and have it put the results like:

 

index.php?=results

 

or something like that...

 

thanks!

 

anything?! i cant find nothing! halp!

[amites]

you mean something like?

 

while ($row = mysql_fetch_assoc($result)) {
echo 'index.php?=variable' . $row['value']
}

[rwachowiak]

you mean something like?

 

while ($row = mysql_fetch_assoc($result)) {
echo 'index.php?=variable' . $row['value']
}

 

yes! where can i find a tutorial on something similiar?!