Question

I have been struggling for days to get a working upload onto the admin section of my site and am almost there…!
I have a table in my database called test with 4 fields – id (int), title (varchar), desc (varchar) and photo (varchar) – the photo field represents the source of the image on the server.
My code is:

<?php include 'dbc.php'; page_protect();

if(!checkAdmin()) {header("Location: login.php");
exit();
}

$host  = $_SERVER['HTTP_HOST'];
$host_upper = strtoupper($host);
$login_path = @ereg_replace('admin','',dirname($_SERVER['PHP_SELF']));
$path   = rtrim($login_path, '/\\');

foreach($_GET as $key => $value) {
    $get[$key] = filter($value);
}

foreach($_POST as $key => $value) {
    $post[$key] = filter($value);
}   
?>

<?php 

$target = "images/test/"; 
$target = $target . basename( $_FILES['photo']['name']); 

$title = mysql_real_escape_string($_POST['title']); 
$desc = mysql_real_escape_string($_POST['desc']);  
$pic = "images/test/" .(mysql_real_escape_string($_FILES['photo']['name']));

mysql_query("INSERT INTO `test` (`title`, `desc`, `photo`) VALUES ('$title', '$desc', '$pic')") ;

if(move_uploaded_file($_FILES['photo']['tmp_name'], $target)) 
 { 

echo "The file ". basename( $_FILES['uploadedfile']['name']). " has been uploaded, and your information has been added to the directory"; 
 } 
 else { 
 echo "Sorry, there was a problem uploading your file."; 
 } 
 ?> 

<form enctype="multipart/form-data" action="uploader.php" method="POST"> 
Title: <input type="text" name="title"><br> 
Description: <input type="text" name = "desc"><br>  
Photo: <input type="file" name="photo"><br> 
<input type="submit" value="Add"> 
</form>

For some reason when the row is entered into mysql a duplicate empty row is inserted so the table looks like:

ID              Title                Desc                   Photo 
15                                                          images/test/
16              test title           test description       images/test/test1.jpg

Is there any reason this is happening from the code above – its fairly rudimentary but given the pain and struggle its taken to get this working I really cant face starting again!!!

Thanks in advance for any help.

JD

Answer 1

as far as I see, your database code is executing when form is first time loading, but no file uploaded yet. So yo’ll need to move your database related code inside

if(move_uploaded_file($_FILES['photo']['tmp_name'], $target))

Whole code:

<?php include 'dbc.php'; page_protect();

if(!checkAdmin()) {header("Location: login.php");
exit();
}

$host  = $_SERVER['HTTP_HOST'];
$host_upper = strtoupper($host);
$login_path = @ereg_replace('admin','',dirname($_SERVER['PHP_SELF']));
$path   = rtrim($login_path, '/\\');

foreach($_GET as $key => $value) {
    $get[$key] = filter($value);
}

foreach($_POST as $key => $value) {
    $post[$key] = filter($value);
}   
?>

<?php 
if($_FILES['photo']) //check if we uploading a file
{
    $target = "images/test/"; 
    $target = $target . basename( $_FILES['photo']['name']); 

    $title = mysql_real_escape_string($_POST['title']); 
    $desc = mysql_real_escape_string($_POST['desc']);  
    $pic = "images/test/" .(mysql_real_escape_string($_FILES['photo']['name']));
if(move_uploaded_file($_FILES['photo']['tmp_name'], $target)) 
{
    mysql_query("INSERT INTO `test` (`title`, `desc`, `photo`) VALUES ('$title', '$desc', '$pic')") ;     

    echo "The file ". basename( $_FILES['uploadedfile']['name']). " has been uploaded, and your information has been added to the directory"; 
} 
else 
{ 
    echo "Sorry, there was a problem uploading your file."; 
    var_dump($_FILES); //for debug purposes
}
} 
?> 

<form enctype="multipart/form-data" action="uploader.php" method="POST"> 
Title: <input type="text" name="title"><br> 
Description: <input type="text" name = "desc"><br>  
Photo: <input type="file" name="photo"><br> 
<input type="submit" value="Add"> 
</form>