php file upload when uploading two files

Question

In php I have a file upload script like this

<form id="formID" method="post" action="'.$_SERVER['REQUEST_URI'].'" enctype="multipart/form-data">
<div>
  <label>'.$this->l('Upload Your Custom Pin').'</label>
  <input type="file" name="file" id="file" />
</div>
<div>
  <label>'.$this->l('Upload Your Store Image').'</label>
  <input type="file" name="store_image" id="store_image" />
</div> 
<input type="submit" name="submit" value="submit" />
</form>          



$image_name = time().$_FILES['file']['name'];
  $store_image_name = time().$_FILES['store_image']['name'];

if(isset($_POST['submit'])) {
  mysql_query('INSERT INTO `'._DB_PREFIX_.'databasename` (`id`, `custom_pin_name`,`store_image_name`) values ('', $custom_pin,$store_img_name) or die(mysql_error());
   if(move_uploaded_file($_FILES['file']['tmp_name'], $tmpName.$image_name) && ($_FILES['store_image']['tmp_name'], $tmpName.$store_image) ) {
        $this->_html .=$this->displayConfirmation($this->l('Settings updated successfully'));
      } else {
         $errors .= $this->displayError($this->l('You Have Some Errors'));
      }
 }

here you can see I am uploading two files and moving them into directory. But when I am doing this to move upload files it is showing error like

Parse error: syntax error, unexpected ',' in line number 18(where I have used move_uploaded_file).

But when I am using only one file like this

 if(isset($_POST['submit'])) {
  mysql_query('INSERT INTO `'._DB_PREFIX_.'databasename` (`id`, `custom_pin_name`,`store_image_name`) values ('', $custom_pin,$store_img_name) or die(mysql_error());
   if(move_uploaded_file($_FILES['file']['tmp_name'], $tmpName.$image_name) ) {
        $this->_html .=$this->displayConfirmation($this->l('Settings updated successfully'));
      } else {
         $errors .= $this->displayError($this->l('You Have Some Errors'));
      }
 }

it is doing fine. So can someone kindly tell me how to solve this issue?

Answer 1

Change your mysql_query line to:

mysql_query('INSERT INTO `'._DB_PREFIX_.'databasename` (`id`, `custom_pin_name`,`store_image_name`) values ('', '$custom_pin','$store_img_name')') or die(mysql_error());

by the way, Your sql has SQL injection and please don't use mysql_* functions. use mysqli or PDO.

Answer 2

You're missing move_uploaded_file after your && . The line

if(move_uploaded_file($_FILES['file']['tmp_name'], $tmpName.$image_name) && ($_FILES['store_image']['tmp_name'], $tmpName.$store_image) ) {

should be

if(move_uploaded_file($_FILES['file']['tmp_name'], $tmpName.$image_name) && move_uploaded_file($_FILES['store_image']['tmp_name'], $tmpName.$store_image_name) ) {

Also you had $store_image , which should be $store_image_name .