Member Avatar for Member #729579

I am fairly new at web developement. I created a web site for the dealership in which the dealer can list used motorcycles for sale along with a picture of the motorcycle. Currently, the client emails me the year and model information, the asking price, and a jpg picture file of the motorcycle. I then update the web page with this information. The client asked me to set up a web form which would allow him to upload this information himself and have it automatically listed on the web page. I am php beginner and would like some suggestions on how to go about creating a web page to allow the client to be able to upload the information and then use that information to update the existing web page. I used Microsoft Expressions 3 to develope the web site. I assume that I would have to use a MySQL database to store the uploaded information and link to the picture file.

  • 2 Contributors
  • 7 Replies
  • 126 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by Member #729579

Dani AI

Generated

— ’s starter script is a useful beginning. Next steps are to turn that proof of concept into a small, secure CRUD admin (add/edit/delete) plus the public listing pages filtered by brand. Use a modern DB client (PDO or mysqli) with prepared statements rather than the old mysql_* approach, and send the image with a form using enctype multipart/form-data (see the PHP upload docs: PHP file uploads and PDO).

Image-handling checklist to avoid common problems and security holes: accept only real images (use finfo_file and getimagesize), enforce a size limit, generate a safe unique filename, store images in a directory that forbids script execution (or outside web root), and create web-sized copies and thumbnails with GD or ImageMagick. Store only the image path in the database and remove the file when a listing is deleted. See finfo_file and the GD docs for helpers.

Protect the admin workflow: require authentication, add CSRF tokens on forms, validate all inputs server-side, escape output with htmlspecialchars when rendering, and use prepared statements to prevent SQL injection. Small illustrative flow (connect with PDO, move the uploaded file, then insert the row):

<?php
// assume $pdo is a connected PDO instance
$uploads = __DIR__ . '/uploads/';
$unique = bin2hex(random_bytes(8)) . '_' . basename($_FILES['photo']['name']);
$dest = $uploads . $unique;

if (isset($_FILES['photo']) && move_uploaded_file($_FILES['photo']['tmp_name'], $dest)) {
    $stmt = $pdo->prepare(
        'INSERT INTO listings (make, model_text, sale_year, asking_price, image_path)
         VALUES (:make, :model, :year, :price, :image)'
    );
    $stmt->execute([
        ':make'  => $_POST['make'],
        ':model' => $_POST['model'],
        ':year'  => $_POST['sale_year'],
        ':price' => $_POST['asking_price'],
        ':image' => $unique
    ]);
}

If EasyPHP is behaving oddly, confirm Apache/MySQL are running, check ports and logs, try a simple phpinfo() test file, or try an alternative dev stack (XAMPP/Laragon) and use phpMyAdmin or a DB client to inspect the schema. Following these steps will make the site maintainable, secure, and easier to extend.

Recommended Answers

All 7 Replies

Member Avatar for G&G Designing

Ok so you need to do something along the lines of mysql. Does the webserver have mysql databases? If you want i can write you a script that will insert the stuff into a mysql database and then ill have another script display the results.

_-EDIT-_

I'm working on a script for you right now, just hold on :)

Edited by G&G Designing because: n/a
Member Avatar for G&G Designing

Here you go... you need to setup a mysql database, and then within that make a table with the following names, "year" "price" "img" "model" - without the quotes ofcourse. If you want me to tell you how to echo them out, just ask :)

<?php 
$hostname = "localhost"; // usually is localhost, but if not sure, check with your hosting company
$db_user = "username"; // change to your database username
$db_password = "passwd"; // change to your database password 
$database = "databse"; // provide your database name 
$db_table = "table_name"; //name of the databases table

$db = mysql_connect($hostname, $db_user, $db_password); 
mysql_select_db($database,$db); 
?> 
<html> 
<head> 
<title>Insert Info</title> 
</head> 
<body> 

<?php 
if (isset($_REQUEST['Submit'])) { 
$sql = "INSERT INTO $db_table(year,price,model,img) values ('".mysql_real_escape_string(stripslashes($_REQUEST['year']))."','".mysql_real_escape_string(stripslashes($_REQUEST['price']))."','".mysql_real_escape_string(stripslashes($_REQUEST['img']))."','".mysql_real_escape_string(stripslashes($_REQUEST['model']))."')";
if($result = mysql_query($sql ,$db)) { 
echo '<h2>Thank you</h2><br>The bike information was entered into the database.'; 
} else { 
echo "ERROR: ".mysql_error(); 
} 
} else { 
?> 
<h1>Insert</h1>
<br>
<form method="post" action=""> 
Year:<br> 
<input type="text" name="year"> 
<br> 
Price: <br> 
<input type="text" name="price"> 
<br>
Img URL:<br>
<input type="text" name="img">
<br>
Model Description:<br>
<input type="text" name="model">
<br><br> 
<input type="submit" name="Submit" value="Submit"> 
</form> 
<?php 
} 
?> 
</body> 
</html>

Let me know if you get any errors, didn't test it!

Edited by G&G Designing because: n/a
Member Avatar for Member #729579

Thank you for your prompt help. I'll have to wait until Monday to find out if the host has MySQL, but I'm pretty sure they do.

Your code gives me a good starting point to get this project started. I realize now that this will be a little more complicated than I first thought. I'll need to have the form display the data currently in the db, allow the user to add, edit, or delete the data, then display the data on two separate web pages based on motorcycle brand. If this was visual basic on a local computer only, I'd have no problem with it.

The web site I'm working on is www.bmwmotorcyclesofbatonrouge.net. The used motorcycle pages are under motorcycles. I'm looking for sample bits of code and ideas on how to go about accomplishing this task.

Again, thank you for your help.

Member Avatar for G&G Designing

If they don't have mysql, then get a new host

Member Avatar for Member #729579

I don't have control over that. I've taken over the web re-design for the client last year and everything was already set up. I have another site that I created and maintain for our local motorcycle club, and it's hosted at hostmonster.com. I find I have a lot more freedom and access with them then I do with the motorcycle dealership. It's probably costing me less than what they are paying too!!

Member Avatar for G&G Designing

Yeah i pay 25$ a year to get unlimited everything.. its not the best but its extrememly cheap...

Member Avatar for Member #729579

The bike club pays something like 7 or 8 dollars a month for unlimited everything. Yours seems to be much cheaper.

I'm getting frustrated trying to set up this EasyPHP WAMP I downloaded so that I can test the web pages and MySQL that I am trying to learn. Guess it's time for a break!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.