如何在多部分表单上使用AJAX，Javascript和PHP？

Question

I have this update status form for my current project. As of now I am able to update my status with HTML entries only. I was wondering how I would go about allowing users to update with a photo. I know that the input type must be "file" and I need to add "enctype="multipart/form-data" to the form. What parts of the wall.js and functions.php do I need to modify to allow status update with photos. I do have a upload.php script but don't know how I can get it all to work together. Any clues or direction to try next would be great.

HTML Form

<form method="post" action="">
<input type="text" name="update" id="update">
<br />
<input type="submit" id="update_button"  class="update_button"/>
</form>

wall.js //update status

$(document).ready(function()
{
$(".update_button").click(function()
{
var updateval = $("#update").val().split('\\').pop();
var dataString = 'update='+ updateval;
if(updateval=='')
{
alert("Please Enter Some Text");
}
else
{
$("#flash").show();
$("#flash").fadeIn(400).html('Loading Update...');
$.ajax({
type: "POST",
url: "message_ajax.php",
data: dataString,
cache: false,
success: function(html)
{
$("#flash").fadeOut('slow');
$("#content").prepend(html);
$("#update").val('');
$("#update").focus();
$("#stexpand").oembed(updateval);
}
});
}
return false;
});
}

Functions.php //Insert Update

public function Insert_Update($id, $update)
{
$update=htmlentities($update);
$time=time();
$ip=$_SERVER['REMOTE_ADDR'];
$query = mysql_query("SELECT msg_id,message FROM `messages` WHERE id_fk='$id' order by msg_id desc limit 1") or die(mysql_error());
$result = mysql_fetch_array($query);
if ($update!=$result['message']) {
$query = mysql_query("INSERT INTO `messages` (message, id_fk, ip,created) VALUES ('$update', '$id', '$ip','$time')") or die(mysql_error());
$newquery = mysql_query("SELECT M.msg_id, M.id_fk, M.message, M.created, U.username FROM messages M, users U where M.id_fk=U.id and M.id_fk='$id' order by M.msg_id desc limit 1 ");
$result = mysql_fetch_array($newquery);
return $result;
}
else
{
return false;
}
}

Answer 1

On the PHP side, see the "Handling File Uploads" section of the PHP manual at http://www.php.net/manual/en/features.file-upload.php . Chances are you'll want to use the "POST method uploads" (a la the $_FILES magic variable). Read all five sub-sections there to know how it all works and avoid problems.

Oh, and before putting any user input into your SQL queries, make sure to escape it using mysql_real_escape_string() / mysql_escape_string() . Hopefully that stuff wasn't in your example only because you were trying to keep your posting brief.