Php使用if else语句从另一个文件调用变量

Question

I used this upload.php file to validate/store the upload image. Then the image will convert into base64 to store into database. In my save.php file, I include "upload.php"; and call the $hex_string and pass to a global variable $NewHexString. But seem in my save.php it return a null value.

p/s : from console upload.php I can see $hex_string return a value.

upload.php

$file = $_FILES['fileUpload'];  
$fileName = $_FILES['fileUpload']['name'];
$fileTmpName = $_FILES['fileUpload']['tmp_name'];  //directory location 
$fileSize = $_FILES['fileUpload']['size'];
$fileError = $_FILES['fileUpload']['error'];       //default 0 | 1 got error

print_r ($file);

$fileExt = explode('.', $fileName);           //split file name to get ext.
$fileActualExt = strtolower(end($fileExt));     //change to lowercase for the extension file
$allowed = array('jpg','jpeg','png');   

//$hex_string = 90707;   
// if I hardcode the value here it able pass this value to database. 
// But when I put inside if..else statement, it will return null.

if(in_array($fileActualExt, $allowed)){
  if($fileError === 0){
    if($fileSize < 500000){

      $fileDestination = './uploads/'.$fileName;                    
      move_uploaded_file($fileTmpName , $fileDestination); 

      $data = file_get_contents($fileTmpName);
      $hex_string = base64_encode($data);

      echo $hex_string;
      // print_r ($hex_string); 

    }else{
      echo "You files is too big!";
    }   
  }else{
    echo "Error occur when upload file!"; 
  }
}else{
  echo "You cannot upload files of this type!";
}

save.php that I use to call $hex_string and pass to global variable.

<?
$propertyID = "1";
include($_SERVER['DOCUMENT_ROOT'] . '/PDOfile.php'); 
$ehorsObj = new TM();
$ehorsObj->TM_CONNECT($propertyID);

include "upload.php";
$NewHexString = $hex_string;   //<-- return a null value??

$method = $_POST['method'];
$method();

/** EDIT **/
function editPropertyMasterData() {
    global $ehorsObj;   
    global $NewHexString;
    
    $propertyID     = (isset($_POST['propertyID']) ? $_POST['propertyID'] : '');
    $propertyName   = (isset($_POST['propertyName']) ? $_POST['propertyName'] : '');
    $propertyColor   = (isset($_POST['propertyColor']) ? $_POST['propertyColor'] : '');
    $businessRegistrationNo   = (isset($_POST['businessRegistrationNo']) ? $_POST['businessRegistrationNo'] : '');
    $noOfRooms   = (isset($_POST['noOfRooms']) ? $_POST['noOfRooms'] : '');
    $active         = (isset($_POST['active']) ? $_POST['active'] : '');

    $sqlUpdate = " UPDATE tblProperty
                      SET propertyName = '" . $propertyName . "',
                      propertyLogo = '" . $NewHexString . "',
                      propertyColor = '" . $propertyColor . "',
                      businessRegistrationNo = '" . $businessRegistrationNo . "',
                      noOfRooms = '" . $noOfRooms . "',
                      active = '" . $active . "'
                   WHERE propertyID = '" . $propertyID . "' ";
    $ehorsObj->ExecuteData($sqlUpdate, $ehorsObj->DEFAULT_PDO_CONNECTIONS);
}

?>

</div>

Answer 1

you could return an array of data from the upload file:

if (!in_array($fileActualExt, $allowed)) {
    return ['error' => 'You cannot upload files of this type!'];
}

if ($fileError !== 0) {
    return ['error' => 'Error occur when upload file!'];
}

if ($fileSize > 500000) {
    return ['error' => 'Your file size is too big!'];
}

$fileDestination = './uploads/' . $fileName;                    
move_uploaded_file($fileTmpName, $fileDestination); 

$data = file_get_contents($fileTmpName);

return ['hexString' => base64_encode($data)];

Now, in your save.php file you check the payload like:

$propertyID = "1";

include($_SERVER['DOCUMENT_ROOT'] . '/PDOfile.php'); 

$ehorsObj = new TM();
$ehorsObj->TM_CONNECT($propertyID);

$uploadPayload = require "upload.php";

if (isset($uploadPayload['error'])) {
    echo $uploadPayload['error']);
    // do something in case of error
}

$method = $_POST['method'];
$method($ehorsObj, $uploadPayload['hexString']);

/** EDIT **/
function editPropertyMasterData($ehorsObj, $NewHexString)
{
    $propertyID     = (isset($_POST['propertyID']) ? $_POST['propertyID'] : '');
    $propertyName   = (isset($_POST['propertyName']) ? $_POST['propertyName'] : '');
    $propertyColor   = (isset($_POST['propertyColor']) ? $_POST['propertyColor'] : '');
    $businessRegistrationNo   = (isset($_POST['businessRegistrationNo']) ? $_POST['businessRegistrationNo'] : '');
    $noOfRooms   = (isset($_POST['noOfRooms']) ? $_POST['noOfRooms'] : '');
    $active         = (isset($_POST['active']) ? $_POST['active'] : '');

    $sqlUpdate = " UPDATE tblProperty
                      SET propertyName = '" . $propertyName . "',
                      propertyLogo = '" . $NewHexString . "',
                      propertyColor = '" . $propertyColor . "',
                      businessRegistrationNo = '" . $businessRegistrationNo . "',
                      noOfRooms = '" . $noOfRooms . "',
                      active = '" . $active . "'
                   WHERE propertyID = '" . $propertyID . "' ";
    $ehorsObj->ExecuteData($sqlUpdate, $ehorsObj->DEFAULT_PDO_CONNECTIONS);
}

Things you should consider:

1. Avoid using global variables
2. Use prepared statements to avoid SQL injections