I'm still getting the errors. I changed the code but also added a few things. And I cannot get my code to INSERT into the database table.
PHP Code:
<?php
//Database access
$dbh = @mysql_connect("localhost", "admin", "balls") OR die ('Could not connect: ' . mysql_error());
@mysql_select_db ('dexdog') OR die ('Could not select database: ' . mysql_error());
// Define Constants
define ("FILEREPOSITORY","C:\\Program Files\\Web Design\\wamp\\www\\dexdog\\photos\\");
//Check if file was posted
if(is_uploaded_file($_FILES['photo']['tmp_name'])) {
//Check to see if file was a photo/picture
if(($_FILES['photo']['type']) != ('image/jpeg' || 'image/gif' || 'image/bmp')){
echo "<p>Photos must be JPG/JPEG, GIF, or BMP file formats please, most digital cameras will take pictures in JPG/JPEG format. If your camera takes pictures in TIFF or another format not currently supported by this site, please contact us and we will try to help remedy the problem. Thank you.</p>";
} else { //Move file to destination
$ownername = $_POST['ownername'];
$dogname = $_POST['dogname'];
$location = $_POST['location'];
echo "$ownername <br />";
echo "$dogname <br />";
echo "$location <br />";
$query = "INSERT INTO photos (owner, dog, location, photo, reg_date) VALUES ($ownername, $dogname, $location, NULL, NOW())";
$result = mysql_query($query);
if($_FILES['photo']['type'] == "image/jpeg"){
$result = move_uploaded_file($_FILES['photo']['tmp_name'],FILEREPOSITORY."\\" . $dogname . ".jpg");
} elseif($_FILES['photo']['type'] == "image/gif") {
$result = move_uploaded_file($_FILES['photo']['tmp_name'],FILEREPOSITORY."\\" . $dogname . ".gif");
} else {
$result = move_uploaded_file($_FILES['photo']['tmp_name'],FILEREPOSITORY . "\\" . $dogname . ".bmp");
}
if($result == 1){ //check if file was moved successfully
$query = NULL;
$query = "SELECT * FROM photos";
$result = mysql_query($query);
while ($row = mysql_fetch_array($result, MYSQL_NUM)){
echo "$row[0], $row[1], ****!";}
echo "<p>successfully uploaded.<p/>";
} else {
echo "<p>Encountered a problem uploading the file.</p>";
}
}
}
?>
I'd like to figure out how to use PEAR modules like MDB2 to protect my databases/SQL injections. Thanks for any info you can give, and I appreciate the help thus far. Thanks.
Bookmarks