I'm using this form to submit articles into the database:
<form enctype="multipart/form-data" method="post" action="add.php">
<input name="title" type="text">
<input name="image" type="file">
<textarea name="text"></textarea>
<input type="submit" name="go" value="Spremi">
</form>
include ("database.php");
$upload_path = "files/images/";
$prefix= date("Hi-mdY")."-";
$file_name = $HTTP_POST_FILES['image']['name'];
$file_name = str_replace(' ', '-', $file_name);
$file_name = str_replace('_', '-', $file_name);
$file_name = strtolower($file_name);
$upload_path = $upload_path . basename($prefix.$file_name);
move_uploaded_file($_FILES['image']['tmp_name'], $upload_path);
$final_file_name = ("/files/images/".$prefix.$file_name);
$date=date("Y.m.d");
$sql="INSERT INTO articles (title, image_link, text, date) VALUES ('$_POST[title]', '$final_file_name', '$_POST[text]', '$date')"
if (mysql_query($sql)){
echo "done";
} else {
echo "error<br>" . mysql_error();
}
And here is the problem:
One of my friends told me that the PHP code in add.php
is incorrect.
This is working for me, but can someone correct the code please.
EDIT:
Thanks guys, I've corrected the code :
<form enctype="multipart/form-data" method="post" action="">
<input name="title" type="text">
<input name="image" type="file">
<textarea name="text"></textarea>
<input type="submit" name="go" value="Submit">
</form>
<?php
if (isset($_POST['go'])){
include ("database.php");
$upload_path = "files/images/";
$prefix= date("Hi-mdY")."-";
$file_name = $_FILES['image']['name'];
$file_name = str_replace(' ', '-', $file_name);
$file_name = str_replace('_', '-', $file_name);
$file_name = strtolower($file_name);
$upload_path = $upload_path . basename($prefix.$file_name);
move_uploaded_file($_FILES['image']['tmp_name'], $upload_path);
$final_file_name = ("/files/images/".$prefix.$file_name);
$title=$_POST['title'];
$text=$_POST['text'];
$date=date("Y.m.d");
$title = mysql_real_escape_string($title);
$final_file_name = mysql_real_escape_string($final_file_name);
$text = mysql_real_escape_string($text);
$sql="INSERT INTO articles (title, image_link, text, date) VALUES ('$title', '$final_file_name', '$text', '$date')";
if (mysql_query($sql)){
echo "done";
} else {
echo "error<br>" . mysql_error();
}
}
?>
Now it's good?