每次我将表单设置为enctype =“multipart / form-data”时，文件上载数据都不会进入数据库

Question

Every time I set my form to enctype="multipart/form-data" the file upload data doesn't go into the database. Every other field goes into the database except for the file upload data, which is set as VARCHAR(255). Here is my form:

<form method="post" action="post.php" enctype="multipart/form-data">
<label for="post_title">Title</label>
<br>
<input type="text" name="post_title" id="post_title" required autofocus>
<br>
<label for="post_content">Content</label>
<br>
<textarea name="post_content" id="post_content" required>Lorem ipsum dolor sit amet, consectetur adipiscing elit. Curabitur a risus ligula. Donec suscipit purus vel euismod feugiat. Suspendisse potenti. Praesent rhoncus mauris urna. Vestibulum non nisi quis sem posuere tempor. Morbi placerat tellus risus, et vestibulum ipsum fermentum ut. Ut faucibus aliquam augue nec laoreet. Fusce lobortis vestibulum tempor. Duis pharetra eget nisi eu dictum. Quisque sed ante eget ipsum lacinia cursus porta ut ante. Morbi venenatis elementum massa nec auctor. Ut id luctus dolor, at viverra arcu. Nulla auctor molestie pharetra.</textarea>
<script>
    CKEDITOR.replace('post_content');
</script>
<br>
<label for="new_category">New Category</label>
<br>
<input type="text" name="new_category" id="new_category">
<br>
<label for="choose_category">Choose Category</label>
<br>
<select name="choose_category" id="choose_category">
<?php
while($column = mysqli_fetch_assoc($result)){
?>
<option value="<?php echo $column['post_category'] ?>"><?php echo $column["post_category"] ?></option>
<?php
}
?>
</select>
<br>
<label for="post_date">Date</label>
<br>
<input type="date" name="post_date" id="post_date" value="<?php echo $current_date ?>" required>
<br>
<label for="post_image">Featured Image</label>
<br>
<input type="file" name="post_image" id="post_image">
<br>
<input type="submit" value="Submit" id="submit">
</form>

Any idea why post_image isn't showing any data in the database after I submit? Here's the PHP:

<?php

$current_date = date("Y-m-d");

if ($_SERVER['REQUEST_METHOD'] == 'POST'){

$post_title = isset($_POST['post_title']) ? $_POST['post_title'] : null;
$post_content = isset($_POST['post_content']) ? $_POST['post_content'] : null;
if($_POST['new_category']==""){
$post_category = ($_POST['choose_category']);
}else{
$post_category = ($_POST['new_category']);
}
$post_date = isset($_POST['post_date']) ? $_POST['post_date'] : null;
$post_image = isset($_POST['post_image']) ? $_POST['post_image'] : null;

$sql = "INSERT INTO posts (post_title, post_content, post_category, post_date, post_image, user_name) VALUES ('$post_title', '$post_content', '$post_category', '$post_date', '$post_image', '$user_name')";

$result = mysqli_query($connection, $sql) or die(mysqli_error($connection));

if(!$result){
        die(mysqli_error($connection));
        }else{
        $s_post="Posted successfully.";
        }

}

?>

Answer 1

Have you read PHP file upload docs? http://php.net/manual/en/features.file-upload.php

$_FILES is an array, it contains uploaded files metadata and paths to uploded temporary files. You have to handle all uploaded files and store them in your application.

You should include something like this in your PHP script:

<?php

// ...

if (!empty($_FILES['post_image'])) {
    $filepath = '/path/to/uploads/directory/' . basename($_FILES['post_image']['name']);

    if (move_uploaded_file(
        $_FILES['post_image']['tmp_name'],
        $filepath
    )) {
        echo 'File stored in ' . $filepath;
    } else {
        throw new Exception('File could not be stored');
    }

    // Here you can store $filepath in database
    // ...
}

Please note that you should add some validation and protection agains common upload attacks.