Why am I getting an Undefined index error?

Question

I added a blob field to add an image to my MYSQL database via a php form and now I am getting an Undefined Error Message on the line that contains the new field and the file for that field did not get uploaded, but all the text fields were added to the database.

Here's my form:

    <form action="http://www.yeahthatrocks.com/update.php" method="post" enctype="multipart/form-data">
    Game Name:  <input name="game_name" type="text" size="25" maxlength="255" /><br></br>
    Release Date:  <input name="release_date" type="text" size="25" /><p></p>

    Cover Image: <input type="file" name="cover" id="cover"><br><br>
<p>Console:
  <select name="game_console">
    <option value="PS3">PS3</option>
    <option value="Xbox 360">Xbox 360</option>
    <option value="Both">Both</option>
  </select>

  Game Category:  
  <select name="game_category">
    <option value="Retail">Retail</option>
    <option value="PSN">PSN</option>
    <option value="Arcade">Arcade</option>
    <option value="DLC">DLC</option>
  </select>

  Game Type:  
  <select name="game_type">
    <option value="Action">Action</option>
    <option value="Action RPG">Action RPG</option>
    <option value="Adventure">Adventure</option>
    <option value="Board">Board</option>
    <option value="Card">Card</option>
    <option value="Casino">Casino</option>
    <option value="Educational">Educational</option>
    <option value="Fighting">Fighting</option>
    <option value="Flight">Flight</option>
    <option value="Game Show">Game Show</option>
    <option value="Hunting">Hunting</option>
    <option value="Music">Music</option>
    <option value="Other">Other</option>
    <option value="Pinball">Pinball</option>
    <option value="Platformer">Platformer</option>
    <option value="Puzzle">Puzzle</option>
    <option value="Racing">Racing</option>
    <option value="RPG">RPG</option>
    <option value="Shooter">Shooter</option>
    <option value="Sports">Sports</option>
    <option value="Strategy">Strategy</option>
    <option value="Virtual Pet">Virtual Pet</option>
  </select>


 </p> 

    <input name="submit" type="submit" value="upload" />
    </form>

And here's the relevant part of update.php:

$sql="INSERT INTO games (game_name, release_date, game_category, game_type, game_console, cover)
VALUES
('$_POST[game_name]','$_POST[release_date]','$_POST[game_category]','$_POST[game_type]','$_POST[game_console]','$_POST[cover]')";

mysql_query($sql);

Does it have something to do with the new field being a binary? The file I'm uploading to that field is 11kb.

Answer 1

First of all, you need to escape all those $_POST variables as you put them into MySQL, read up on SQL injection vulnerabilities and mysql_read_escape_string() ;

Your error is being triggered as you are inserting $_POST['game_type'] and $_POST['console'] but you don't have a form field for them.

EDIT

Your $_POST is missing the 'cover' field as it's a file upload, and therefore will come through as a $_FILES variable instead, with which you will have to read up on uploading files with PHP as you are completely missing this bit of logic.

Answer 2

You don't have input fields for "game_category" "game_type", "game_console" ect.. so those don't exist in $_POST and PHP warnings are probably turned on (Undefined index is a warning). And you should NEVER insert a $_POST straight to the database, at least use the mysql_real_escape_string function before you insert those. Read up on SQL injection and you will understand why.

Answer 3

You're getting an undefined index error because $_POST doesn't contain game_category and game_type and game_console. (or any field is left empty)

Also:

• I think that storing in a file into a database like that, doesn't work. (Example here )
• Putting $_POST (or any user input) variables directly into an sql query is a bad idea, best to escape the values before inserting. see mysql_real_escape_string