将带有FILE和POST变量的bindValue导入SQL DB

Question

I can't seem to get all of these variables to post to my database. It works when I leave out the $_POST of the $file_desc. All of the $_FILE variables pass through to my database. Here's the code for grabbing the variables:

$file_name = $_FILES['image']['name'];
$tmp = explode('.', $file_name);
$file_ext = strtolower(end($tmp));
$file_size = $_FILES['image']['size'];
$file_tmp = $_FILES['image']['tmp_name'];
$file_error = $_FILES['image']['error'];
$file_desc = nl2br($_POST['desc']);

And here's the code for running the query:

$query = $pdo->prepare('INSERT INTO upload (name, type, size, desc) VALUES (?, ?, ?, ?)');
$query->bindValue(1, $file_name);
$query->bindValue(2, $file_ext);
$query->bindValue(3, $file_size);
$query->bindValue(4, $file_desc);

$query->execute();

Answer 1

DESC is MySQL keyword, which is used to sort selected rows in descending order. In your case MySQL thinks it's keyword and not a field name. To make it understand that it's a field - you should put it in apostrophes:

$query = $pdo->prepare('INSERT INTO upload (name, type, size, `desc`) VALUES (?, ?, ?, ?)');

Also I would advice you to learn debugging and pay attention to errors returned: I bet MySQL told you something about "wrong syntax near desc at line 1".