Question

I added a blob field to add an image to my MYSQL database via a php form and now I am getting an Undefined Error Message on the line that contains the new field and the file for that field did not get uploaded, but all the text fields were added to the database.

Here’s my form:

    <form action="http://www.yeahthatrocks.com/update.php" method="post" enctype="multipart/form-data">
    Game Name:  <input name="game_name" type="text" size="25" maxlength="255" /><br></br>
    Release Date:  <input name="release_date" type="text" size="25" /><p></p>

    Cover Image: <input type="file" name="cover" id="cover"><br><br>
<p>Console:
  <select name="game_console">
    <option value="PS3">PS3</option>
    <option value="Xbox 360">Xbox 360</option>
    <option value="Both">Both</option>
  </select>

  Game Category:  
  <select name="game_category">
    <option value="Retail">Retail</option>
    <option value="PSN">PSN</option>
    <option value="Arcade">Arcade</option>
    <option value="DLC">DLC</option>
  </select>

  Game Type:  
  <select name="game_type">
    <option value="Action">Action</option>
    <option value="Action RPG">Action RPG</option>
    <option value="Adventure">Adventure</option>
    <option value="Board">Board</option>
    <option value="Card">Card</option>
    <option value="Casino">Casino</option>
    <option value="Educational">Educational</option>
    <option value="Fighting">Fighting</option>
    <option value="Flight">Flight</option>
    <option value="Game Show">Game Show</option>
    <option value="Hunting">Hunting</option>
    <option value="Music">Music</option>
    <option value="Other">Other</option>
    <option value="Pinball">Pinball</option>
    <option value="Platformer">Platformer</option>
    <option value="Puzzle">Puzzle</option>
    <option value="Racing">Racing</option>
    <option value="RPG">RPG</option>
    <option value="Shooter">Shooter</option>
    <option value="Sports">Sports</option>
    <option value="Strategy">Strategy</option>
    <option value="Virtual Pet">Virtual Pet</option>
  </select>


 </p> 

    <input name="submit" type="submit" value="upload" />
    </form>

And here’s the relevant part of update.php:

$sql="INSERT INTO games (game_name, release_date, game_category, game_type, game_console, cover)
VALUES
('$_POST[game_name]','$_POST[release_date]','$_POST[game_category]','$_POST[game_type]','$_POST[game_console]','$_POST[cover]')";

mysql_query($sql);

Does it have something to do with the new field being a binary? The file I’m uploading to that field is 11kb.

Answer 1

First of all, you need to escape all those $_POST variables as you put them into MySQL, read up on SQL injection vulnerabilities and mysql_read_escape_string();

Your error is being triggered as you are inserting $_POST['game_type'] and $_POST['console'] but you don’t have a form field for them.

EDIT

Your $_POST is missing the ‘cover’ field as it’s a file upload, and therefore will come through as a $_FILES variable instead, with which you will have to read up on uploading files with PHP as you are completely missing this bit of logic.