move_uploaded_file not working

PHP
1

Hi I’m relatively new to programming using PHP, Javascript and Ajax.
I’m trying to upload an image to a folder ‘upload’ within a root directory using an html form.
Here is my form,

<body>
<?php  include("template_admin_header.php"); ?>
    <div id="container">
        <div id="page_content">
        <form name="uploadform" id="uploadform" onsubmit="return false;">
            <fieldset>
                <legend>Advert upload</legend>
                    <div>Advert Title: </div>
                    <input id="thisu" type="hidden" value="<?php echo $u; ?>">
                    <input id="adTitle" type="text" >
                    <span id="adTitlestatus"></span><br />
                    <div>Vehicle price: </div>
                    <input id="price" type="text" >
                    <div>Description: </div>
                    <input id="description" type="text" >
                    <div>year of Registration: </div>
                    <input id="year" type="text" >
                    <div>number of berths: </div>
                    <input id="berth" type="text" ><br />
                    <hr>
                    <input id="uploaded_file" type="file" />
                    <hr>
                    <button id="uploadbtn" onclick="upload()">Post Ad</button>
                <span id="status"></span>
                    <hr>
                </form>
                    </fieldset>
        </div>
    </div>
  <?php  include("user/template_admin_footer.php"); ?>

</body>

I then use javascript/ajax function to validate the form and call PHP
Here is my js function

<script>
function upload(){
var t = _("adTitle").value;
var u = _("thisu").value;
var p = _("price").value;
var d = _("description").value;
var y = _("year").value;
var b = _("berth").value;
var status = _("status");
if(t == ""){
status.innerHTML = "Fill out all of the form data";
} else {
_("uploadbtn").style.display = "none";
status.innerHTML = 'please wait ...';
var ajax = ajaxObj("POST", "upload.php?u="+u);
        ajax.onreadystatechange = function() {
       if(ajaxReturn(ajax) == true) {
           if(ajax.responseText != "upload_success"){
status.innerHTML = ajax.responseText;
_("uploadbtn").style.display = "block";
} else {
window.scrollTo(0,0);
_("uploadform").innerHTML = "Your ad has been placed.";
}
       }
        }
        ajax.send("t="+t+"&u="+u+"&p="+p+"&d="+d+"&y="+y+"&b="+b);
}
}
</script>

I then call PHP to parse the data to the db and the upload file.
This is the PHP

if($t == ""){
echo "The form submission is missing values.";
        exit();
} else if (strlen($t) < 3 || strlen($t) > 100) {
        echo "Ad Title must be greater then 3 characters";
        exit(); 
    } else if (is_numeric($t[0])) {
        echo 'Title cannot begin with a number';
        exit();
    } else {
// END FORM DATA ERROR HANDLING
   // Begin Insertion of data into the database
// Add user info into the database table for the main site table
$upload_sql = "INSERT INTO advert (adTitle, cid, price, description, date_added, year, berth ) VALUES('$t','$cid','$p','$d',now(),'$y','$b')";
$query = mysqli_query($db_conx, $upload_sql); 
$id = mysqli_insert_id($db_conx);
    // Place image in the folder
    $newname = "$id.jpg";
    echo $newname;
    $target ="upload/$newname";
    if(move_uploaded_file($_FILES['uploaded_file']['tmp_name'],$target));{
    echo "success";
    } 
// Email confirmation to user
$to = "$e";     
$from = "info@mysite.co.uk";
$subject = ' Advert Confirmation';
$message = '<!DOCTYPE html><html><head><meta charset="UTF-8"><title> Message</title></head><body style="margin:0px; font-family:Tahoma, Geneva, sans-serif;"><div style="padding:10px; background:#333; font-size:24px; color:#CCC;"><a href="http://www.mysite.co.uk"><img src="/logo.jpg" width="36" height="30" alt="" style="border:none; float:left;"></a> Advert Confirmation</div><div style="padding:24px; font-size:17px;">Hello '.$u.',<br /><br />Your advert has been uploaded successfully:<br /><br /><br /><br /></b></div></body></html>';
$headers = "From: $from\
";
        $headers .= "MIME-Version: 1.0\
";
        $headers .= "Content-type: text/html; charset=iso-8859-1\
";
mail($to, $subject, $message, $headers);
echo "upload_success";
exit();
}
exit();
}

My problem is the move_uploaded_file echo’s success but the image isn’t in the upload folder,
The only error message I get is’ Notice: Undefined index: uploaded_file in /websites/’
I’ve spent the last three days checking forums and any source of information regarding moving uploaded files, could this be that the js/ajax isn’t sending the file info upto PHP or have I got some other part of the cod wrong,
any advice or guidance is gratefully accepted
Thanks in advance

2

You’re not attaching the form data to your AJAX request.

3

Hi Starlion,
many thanks for that,
how do i attach that data
please forgive me as I’m new to this

4

what type of object does ajaxObj() return? far as i know, thats not a standard javascript function, and i see no function definition for it.

5

Wait, since when could file uploads be ajaxed?

6

The data submitted needs to be sanitized before being allowed anywhere near the database (either by use of the mysqli_real_escape_string() string function or more preferably by making use of [URL=“http://php.net/manual/en/mysqli.quickstart.prepared-statements.php”]prepared statements) otherwise your code will be vulnerable to an [URL=“http://php.net/manual/en/security.database.sql-injection.php”]SQL Injection attack. All user submitted data no matter how it’s being submitted (GET, POST or REQUEST arrays or a cookie) must always be considered unsafe untill it has been validated and sanitized.

Change this line:

<form name="uploadform" id="uploadform" onsubmit="return false;">

to:

<form name="uploadform" id="uploadform" onsubmit="return false;" enctype="multipart/form-data">

You could consider using the GD extension on the image by having the GD extension create a copy of the image, if the copying fails, treat the file submitted as an image to be suspect and delete it, with a suitable error message to the user. If the copying worked, use the copy.

7