如何在id =处插入图片名称？ …在mySQL [PHP]中

Question

I am trying to upload avatar images to MySQL database. My code is working correctly, but the problem is with the SQL query...

This is my code:

<?php
if(isset($_POST)){
    if(isset($_FILES['avatar'])){
      $errors= array();
      $file_name = $_FILES['avatar']['name'];
      $file_size =$_FILES['avatar']['size'];
      $file_tmp =$_FILES['avatar']['tmp_name'];
      $file_type=$_FILES['avatar']['type'];

//print_r($_FILES['avatar']['name']); 

  $file_ext = pathinfo($_FILES['avatar']['name'], PATHINFO_EXTENSION);


      //$file_ext=strtolower(end(explode('.',$_FILES['avatar']['name'])));

      $expensions= array("jpg","gif","jpeg","png","bmp");

      if(in_array($file_ext,$expensions)=== false){
         $errors[]="extension not allowed, please choose a JPG, GIF, BMP or PNG formats...";
      }

      if($file_size > 8000000){
         $errors[]='File size must be excately 8 MB';
      }
//print_r($file_tmp); exit;
      if(empty($errors)==true){
          $randname = (rand(0,1000));
          $file_data=date("d-m-Y-H-i-s");
          $file_name=$file_data.$randname;
         move_uploaded_file($file_tmp,"avatars/".$file_name);
         echo "Success";
        $currentsessionid = $_SESSION["userid"];
        $query = $conn->prepare("UPDATE users SET
avatar = ?, WHERE id = ?");
$insert = $query->execute(array(
      "$file_name","$currentsessionid"
));
      }else{
         print_r($errors);
      }
   }
} } ?>  

Look at the SQL query carefully, I have table users and columns id , avatar ... avatar column is varchar , just i want to put filename to avatar where current logged in user id ..

Answer 1

There is an error in your insert-statement.

An Insert have to look something like that:

INSERT INTO users (avatar, id) VALUES('avatar.png', $sessionid)

Answer 2

There is no session_start() in the code you've shown us, nor is there anything to initialize your database connection. You've also not said what the problem is .

You should be checking the return values from $conn->prepare() and $query->execute() . If they are false, then you should be polling for errors then quoting them here if you can't solve the problem yourself.

INSERT INTO users SET avatar = ?, WHERE id = ?

...is not SQL. You are confusing the syntax for INSERT with the syntax for UPDATE. jiGL has provided and example of how to to write an INSERT properly. Since you presumably already have a rescord in users representing the user, and want to change this to include the avatar path:

UPDATE users SET avatar = ? WHERE id = ?

BTW - the filename you are generating (kudos for not using the name supplied by the user) doesn't have an extension which makes it rather difficult to serve up again.