无法在数据库中存储文件详细信息

Question

I am trying to store uploaded file details in my database. 我正在尝试将上传的文件详细信息存储在数据库中。 I have written the following code, but I am unable to understand why its not reading the Query Block. 我已经编写了以下代码，但是我无法理解为什么它没有读取查询块。 Its not generating any MySQL error message or any other Syntax error. 它不会生成任何MySQL错误消息或任何其他语法错误。 Kindly check it. 请检查一下。

<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Untitled Document</title>
</head>

<body>
<form action="file_upload_test2.php" method="post"
enctype="multipart/form-data">
<label for="file">Filename:</label>
<input type="file" name="file" id="file"><br>
<input type="file" name="file2" id="file"><br>
<input type="file" name="file3" id="file"><br>
<input type="submit" name="submit" value="Submit">
</form>



</body>
</html>


<?php

include 'connect.php';

$allowedExts = array("gif", "jpeg", "jpg", "png");
$extension = end(explode(".", $_FILES["file"]["name"]));


if ((($_FILES["file"]["type"] == "image/gif")
|| ($_FILES["file"]["type"] == "image/jpeg")
|| ($_FILES["file"]["type"] == "image/jpg")
|| ($_FILES["file"]["type"] == "image/pjpeg")
|| ($_FILES["file"]["type"] == "image/x-png")
|| ($_FILES["file"]["type"] == "image/png"))
//&& ($_FILES["file"]["size"] < 200000)
&& in_array($extension, $allowedExts))
  {
  if ($_FILES["file"]["error"] > 0)
    {
    echo "Return Code: " . $_FILES["file"]["error"] . "<br>";
    }
  else
    {
    echo "Upload: " . $_FILES["file"]["name"] . "<br>";
    echo "Type: " . $_FILES["file"]["type"] . "<br>";
    echo "Size: " . ($_FILES["file"]["size"] / 200000) . " kB<br>";




        $image_name=        $_FILES["file"]["name"];  

        $path=              move_uploaded_file($_FILES["file"]["tmp_name"],
                                    "upload/" . rand().$_FILES["file"]["name"]);            

            echo "Stored in: " . "upload/" . $_FILES["file"]["name"];     

            if (mysql_query ("Insert into category_images (image_name,image_location) VALUES ('$image_name', '$path')"))
            {
                echo "successfull"; 
                } 
                else {
                    mysql_error();
                    } 
      }
    }

else
  {
  echo "Invalid file";
  }


?>

Answer 1

try 尝试

    $sql = "INSERT INTO `category_images` (`image_name`,`image_location`) VALUES ('".$image_name."', '".$path."')";

    $result = mysql_query($sql);
    if ($result)
    {
          // Successful query execution
          echo "successfull"; 
    } 
    else {
          // Some error occured while executing query.
          // Show some useful information using echo/print.
          // Then stop execution after taking other necessary steps

          die(mysql_error());
    }

also, your database is vulnerable to SQL Injection attack since you are not sanitizing your input. 另外，由于您没有对输入进行清理，因此数据库容易受到SQL Injection攻击。 You should use at least mysql_real_escape_string() method to ensure that this doesn't occur. 您应该至少使用mysql_real_escape_string（）方法来确保不会发生这种情况。

If the above doesn't work, try checking if your connection parameters are ok and if MySQL is running. 如果上述方法不起作用，请尝试检查您的连接参数是否正常以及MySQL是否正在运行。

无法在数据库中存储文件详细信息

问题描述

1 个解决方案

解决方案1
0 已采纳 2013-07-24 06:52:48

无法在数据库中存储文件详细信息

问题描述

1 个解决方案

解决方案1 0 已采纳 2013-07-24 06:52:48

解决方案1
0 已采纳 2013-07-24 06:52:48