Member Avatar for gogs85

How to upload image to database and move into image folder this is my function for other rows:

<?php
function add_post($title, $contents, $category) {
    $title      = mysql_real_escape_string($title);
    $contents   = mysql_real_escape_string($contents);
    $category   = (int) $category;
    //var_dump($category);

    mysql_query("INSERT INTO `posts` SET

            `cat_id`        = '{$category}',
            `title`         = '{$title}',
            `image`         = '{$image}',
            `contents`      = '{$contents}',
            `date_posted`   = NOW()");
}

und this is post page:

<?php 
    include_once('../resources/init.php'); 


    if ( isset($_POST['title'], $_POST['contents'], $_POST['category']) ) {
            //var_dump($_POST);
        $errors = array();

        $title      = trim($_POST['title']);
        $contents   = trim($_POST['contents']);

        if ( empty($title)) {
            $errors[] = 'You need to supply a title';
        } else if ( strlen($title) > 255 ){
            $errors[] = 'The title can not be longer than 255  characters'; 
        }
        if ( empty($contents) ) {
            $errors[] = 'You need to supply some text';
        }
        if ( ! category_exists('id', $_POST['category']) ){
            $errors[] = 'That category does not exist'; 
        }

        if ( empty($errors) ) {
            add_post($title, $contents, $_POST['category']);

            $id = mysql_insert_id();

            header('location: add_post.php?id=' . $id);
            die();
        }
    }
?>
  • 2 Contributors
  • 3 Replies
  • 322 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by gogs85

Dani AI

Generated

Quick note for and follow-up to : your addpost call never receives an image filename (the INSERT references $image but the function signature and the place you call it don't pass one). Minimal, safe workflow: validate the uploaded file, create a secure unique filename, move it to a writeable/uploads directory (preferably outside the public document root), then pass that filename/path into your DB insert. Also stop using deprecated mysql* functions — use PDO or mysqli with prepared statements.

Checklist and important checks

  • Ensure the form uses enctype="multipart/form-data" and check $_FILES['…']['error'] for UPLOAD_ERR_OK.
  • Verify the file is an actual image (use finfo or getimagesize) and restrict allowed MIME types and a size limit.
  • Never trust the original filename: generate a unique name (uniqid or random bytes) and use the extension mapped from the MIME type.
  • Store only the file path (or filename) in the DB, not raw uploaded data, unless you have a specific reason to use BLOBs.
  • Keep uploads outside the webroot or disable script execution in the uploads folder with server rules.

Example table and insert (adapt to PDO/mysqli)

CREATE TABLE posts (
  id INT AUTO_INCREMENT PRIMARY KEY,
  cat_id INT NOT NULL,
  title VARCHAR(255) NOT NULL,
  image VARCHAR(255),
  contents TEXT NOT NULL,
  date_posted DATETIME DEFAULT CURRENT_TIMESTAMP
);
$stmt = $pdo->prepare(
  "INSERT INTO posts (cat_id,title,image,contents) VALUES (:cat,:title,:image,:contents)"
);
$stmt->execute([':cat'=>$catId,':title'=>$title,':image'=>$filename,':contents'=>$contents]);

Troubleshooting tips: check upload_max_filesize and post_max_size in php.ini, verify directory permissions, and log $_FILES during development. 's pointer about moving the uploaded file is on the right track — add the validations above and pass the saved filename into your add_post implementation.

Recommended Answers

All 3 Replies

Member Avatar for malatamil

$uploadDir = 'backend/'; //path for where u have to upload
$filename = $_FILES['photo']['name'];
$tmpname = $_FILES['photo']['tmp_name'];

$filePath = $uploadDir . $filename;
$result1 = move_uploaded_file($tmpname, $filePath);

insert into review (id,filename, filepath) values('','$filename','$filePath')");

<input type="file" name="photo">

Member Avatar for gogs85

Thanks!

Member Avatar for gogs85

Thanks!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.