PHP文件上传名称到sql表

Question

I am trying to allow for file upload and then writing the name of that file into a SQL table so it can be displayed. My form looks like this:

<form class="addProduct" name="addNewProduct" action="add_product.php" method="GET">
<div class="form-group">
<label for="productImgName">Image:</label>
<input type="file" id="productImgName" name="productImgName">
<p class="help-block">This will be re-sized</p>
</div>
</form>

And then the PHP file is:

$target = "images/";
$target = $target . basename( $_FILES['productImgName']['name']);

$Filename=basename( $_FILES['productImgName']['name']);


 if(move_uploaded_file($_FILES['productImgName']['tmp_name'], $target)) {
echo "The file ". basename( $_FILES['productImgName']['name']). " has been uploaded, and your information has been added to the directory";

mysqli_query("INSERT INTO products (productImgName)
VALUES ('$Filename')") ;
} else {
//Gives and error if its not
echo "Sorry, there was a problem uploading your file.";
}

It won't upload and Im not sure why.

Answer 1

There are two issues with your form element:

• You cannot use the GET method to upload files

• You need to specify the enctype attribute

  <form class="addProduct" name="addNewProduct" action="add_product.php" method="POST" enctype="multipart/form-data">
  

Documentation.

Also note that the filename is user input and should be treated as such. Sanitize it before adding it to your query or use prepared statements.