Question

Basically I have written a script to allow the user in the back end to upload pictures for the gallery. The script is supposed to upload the file to the server and then post the file name and info into the database.

It always uploads the file to the server without fail, however for some reason it only posts it to the database occasionally. Sometimes it works fine but 8 times out of 10 it uploads the file and thats it, the script is as follows.

<?php  

 //This is the directory where images will be saved  
 $target = "images/";  
 $target = $target . basename( $_FILES['photo']['name']);  

 //This gets all the other information from the form  
 $name=$_POST['name'];  
 $caption=$_POST['caption'];  
 $pic=($_FILES['photo']['name']);  
 $live=$_POST['live']; 

 //Connecting to the database 
 require_once('../Connections/tim.php');  


 //Writes the information to the database  
 mysql_query("INSERT INTO `gallery` VALUES ('$name', '$caption', '$pic', '$live')") ;  

 //Writes the photo to the server  
 if(move_uploaded_file($_FILES['photo']['tmp_name'], $target))  
 {  

 //Tells you if its all ok  
 echo "The file ". basename( $_FILES['uploadedfile']['name']). " has been uploaded successfully, press back to upload more";  
 }  
 else {  

 //Gives and error if its not  
 echo "Sorry, there was a problem uploading your file.";  
 }  
 ?>  

Answer 1

You really should read something on SQL Injection and you should use PDO or mysqli (as jeroen) suggested.

But debugging at your situation could be done by this:

mysql_query("INSERT INTO `gallery` VALUES ('$name', '$caption', '$pic', '$live')") ;  
if( mysql_errno() != 0){
     // mysql error
     // note: message like this should never appear to user, should be only stored in log
     echo "Mysql error: " . htmlspecialchars( mysql_error());
     die();
}

And you have to escape your database inputs at least by mysql_real_escape_string().