PHPFixing
  • Privacy Policy
  • TOS
  • Ask Question
  • Contact Us
  • Home
  • PHP
  • Programming
  • SQL Injection
  • Web3.0

Tuesday, July 26, 2022

[FIXED] How to upload file using a record insert wizard? Dreamweaver php

 July 26, 2022     dreamweaver, html, mysql, php     No comments   

Issue

Here is the code php for insert

<?php
if (!function_exists("GetSQLValueString")) {
function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "") 
{
  if (PHP_VERSION < 6) {
    $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;
  }

  $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);

  switch ($theType) {
    case "text":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;    
    case "long":
    case "int":
      $theValue = ($theValue != "") ? intval($theValue) : "NULL";
      break;
    case "double":
      $theValue = ($theValue != "") ? doubleval($theValue) : "NULL";
      break;
    case "date":
      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";
      break;
    case "defined":
      $theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;
      break;
  }
  return $theValue;
}
}

$editFormAction = $_SERVER['PHP_SELF'];
if (isset($_SERVER['QUERY_STRING'])) {
  $editFormAction .= "?" . htmlentities($_SERVER['QUERY_STRING']);
}

if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "form1")) {
  $insertSQL = sprintf("INSERT INTO siswa (NISN, Kode_KK, Nama_Siswa, Alamat_Siswa, Tgl_Lahir, Foto_siswa) VALUES (%s, %s, %s, %s, %s, %s)",
                       GetSQLValueString($_POST['NISN'], "int"),
                       GetSQLValueString($_POST['Kode_KK'], "int"),
                       GetSQLValueString($_POST['Nama_Siswa'], "text"),
                       GetSQLValueString($_POST['Alamat_Siswa'], "text"),
                       GetSQLValueString($_POST['Tgl_Lahir'], "date"),
                       GetSQLValueString($_POST['Foto_siswa'], "text"));

  mysql_select_db($database_praukkcon, $praukkcon);
  $Result1 = mysql_query($insertSQL, $praukkcon) or die(mysql_error());
}
?>

And here is my insert form code

<form method="post" name="form1" action="<?php echo $editFormAction; ?>" enctype="multipart/form-data">
  <table width="490" height="308" align="center">
    <tr valign="baseline">
      <td height="24" align="right" valign="middle" nowrap><div align="center">NISN:</div></td>
      <td valign="middle"><input type="text" name="NISN" value="MAKS 10" size="32" onfocus="this.value = '';" onblur="if (this.value == '') {this.value = 'MAKS 10';}"></td>
    </tr>
    <tr valign="baseline">
      <td height="24" align="right" valign="middle" nowrap><div align="center">Kode_KK:</div></td>
      <td valign="middle"><input type="text" name="Kode_KK" value="MAKS 4" size="32" onfocus="this.value = '';" onblur="if (this.value == '') {this.value = 'MAKS 4';}"></td>
    </tr>
    <tr valign="baseline">
      <td height="24" align="right" valign="middle" nowrap><div align="center">Nama_Siswa:</div></td>
      <td valign="middle"><input type="text" name="Nama_Siswa" value="MAKS 50" size="32" onfocus="this.value = '';" onblur="if (this.value == '') {this.value = 'MAKS 50';}"></td>
    </tr>
    <tr valign="baseline">
      <td height="24" align="right" valign="middle" nowrap><div align="center">Alamat_Siswa:</div></td>
      <td valign="middle"><input type="text" name="Alamat_Siswa" value="" size="32">      </td>
    </tr>
    <tr valign="baseline">
      <td height="24" align="right" valign="middle" nowrap><div align="center">Tgl_Lahir:</div></td>
      <td valign="middle"><input type="text" name="Tgl_Lahir" value="YYYY-MM-DD" size="32" onfocus="this.value = '';" onblur="if (this.value == '') {this.value = 'YYYY-MM-DD';}"></td>
    </tr>
    <tr valign="baseline">
      <td height="24" align="right" valign="middle" nowrap><div align="center">Foto_siswa:</div></td>
      <td valign="middle"><input type="file" name="Foto_siswa" value="" size="32">      </td>
    </tr>
    <tr valign="baseline">
      <td height="26" align="right" valign="middle" nowrap><div align="center"></div></td>
      <td valign="middle"><div align="center">
        <input type="submit" value="INSERT DATA">
      </div></td>
    </tr>
  </table>
  <input type="hidden" name="MM_insert" value="form1">
</form>

That's all, if youre wondering where is the connection code, i use this form using include. so the connection function is in the main page.


Solution

Hi you can try this code, please make sure you will understand commented instruction to upload files. 1: when ever using file uploader first we mast use enctype="multipart/form-data" in form tag.

2: Files are retrieved after post using $_FILES array not $_POST

3: We can save file directly in DB or a directory

i: If you are saving files directly in db then you should use blob datatype in db column name.

ii: If you are saving file in a directory and save its name in db. [I explain same thing in your code]

<?php
if (!function_exists("GetSQLValueString")) {

function GetSQLValueString($theValue, $theType, $theDefinedValue = "", $theNotDefinedValue = "") 
{

  if (PHP_VERSION < 6) {

    $theValue = get_magic_quotes_gpc() ? stripslashes($theValue) : $theValue;

  }

  $theValue = function_exists("mysql_real_escape_string") ? mysql_real_escape_string($theValue) : mysql_escape_string($theValue);


  switch ($theType) {

    case "text":

      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";

      break;    

    case "long":

    case "int":

      $theValue = ($theValue != "") ? intval($theValue) : "NULL";

      break;

    case "double":

      $theValue = ($theValue != "") ? doubleval($theValue) : "NULL";

break;
    case "date":

      $theValue = ($theValue != "") ? "'" . $theValue . "'" : "NULL";

      break;

    case "defined":

$theValue = ($theValue != "") ? $theDefinedValue : $theNotDefinedValue;

break;

  }

  return $theValue;

}

}


$editFormAction = $_SERVER['PHP_SELF'];

if (isset($_SERVER['QUERY_STRING'])) {

  $editFormAction .= "?" . htmlentities($_SERVER['QUERY_STRING']);

}


if ((isset($_POST["MM_insert"])) && ($_POST["MM_insert"] == "form1")) {

 //Here First upload a files in physical(drive) location

 $_FileNameToSave = ''; //If file is not uploaded then initialize it value balnk

 $target_file = '/fileuploader'; //put here your uploaded directory name or create a folder "fileuploader" in your project root directory

  if($_FILES['Foto_siswa']['name'] && sizeof($_FILES['Foto_siswa']['name']) > 0) {

        if (move_uploaded_file($_FILES["Foto_siswa"]["tmp_name"], $target_file)) 
{

            $_FileNameToSave = $_FILES['Foto_siswa']['name'];

        }

  }

  $insertSQL = sprintf("INSERT INTO siswa (NISN, Kode_KK, Nama_Siswa, Alamat_Siswa, Tgl_Lahir, Foto_siswa) 
VALUES (%s, %s, %s, %s, %s, %s)",

GetSQLValueString($_POST['NISN'], "int"),

GetSQLValueString($_POST['Kode_KK'], "int"),

GetSQLValueString($_POST['Nama_Siswa'], "text"),

                      GetSQLValueString($_POST['Alamat_Siswa'], "text"),

                       GetSQLValueString($_POST['Tgl_Lahir'], "date"),

                       GetSQLValueString($_FileNameToSave, "text"));//file name to save in db


  mysql_select_db($database_praukkcon, $praukkcon);

  $Result1 = mysql_query($insertSQL, $praukkcon) or die(mysql_error());

}

?>


Answered By - Harish Rawat
Answer Checked By - David Goodson (PHPFixing Volunteer)
  • Share This:  
  •  Facebook
  •  Twitter
  •  Stumble
  •  Digg
Newer Post Older Post Home

0 Comments:

Post a Comment

Note: Only a member of this blog may post a comment.

Total Pageviews

Featured Post

Why Learn PHP Programming

Why Learn PHP Programming A widely-used open source scripting language PHP is one of the most popular programming languages in the world. It...

Subscribe To

Posts
Atom
Posts
Comments
Atom
Comments

Copyright © PHPFixing